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About This Book 


This user’s manual provides the architectural overview, programming model, and detailed information 
about the registers, the instruction set, and operations of the IBM™ PowerPC™ 405 (PPC405 core) 
32-bit RISC embedded processor core. 


The PPC405 RISC embedded processor core features: 


* PowerPC Architecture™ 

¢ Single-cycle execution for most instructions 

¢ Instruction cache unit and data cache unit 

¢ Support for little endian operation 

¢ Interrupt interface for one critical and one non-critical interrupt signal 
« JTAG interface 

« Extensive development tool support 


Who Should Use This Book 


This book is for system hardware and software developers, and for application developers who need 
to understand the PPC405 core. The audience should understand embedded processor design, 
embedded system design, operating systems, RISC processing, and design for testability. 


How to Use This Book 


This book describes the PPC405 device architecture, programming model, external interfaces, 
internal registers, and instruction set. This book contains the following chapters, arranged in parts: 


Chapter 1 Overview 

Chapter 2 Programming Model 

Chapter 3 Initialization 

Chapter4 = Cache Operations 

Chapter 5 Fixed-Point Interrupts and Exceptions 
Chapter 6 Timer Facilities 

Chapter 7 Memory Management 

Chapter 8 Debugging 

Chapter 9 Instruction Set 

Chapter 10 Register Summary 


This book contains the following appendixes: 


Appendix A Instruction Summary 
Appendix B _ Instructions by Category 
Appendix C Code Optimization and Instruction Timings 
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To help readers find material in these chapters, the book contains: 


Contents, on page v. 
Figures, on page xv. 
Tables, on page xviii. 
Index, on page X-1. 


Conventions 


The following is a list of notational conventions frequently used in this manual. 


ActiveLow 


if...then 


do 


leave 
FLD 
FLD, 
FLDp-b 


xxii 


else... 


An overbar indicates an active-low signal. 
A decimal number 

A hexadecimal number 

A binary number 

Assignment 

AND logical operator 

NOT logical operator 

OR logical operator 

Exclusive-OR (XOR) logical operator 

Twos complement addition 

Twos complement subtraction, unary minus 
Multiplication 

Division yielding a quotient 

Remainder of an integer division; (83 % 32) = 1. 
Concatenation 

Equal, not equal relations 

Signed comparison relations 

Unsigned comparison relations 


Conditional execution; if condition then a else b, where a and b represent 
one or more pseudocode statements. Indenting indicates the ranges of a 
and b. If bis null, the else does not appear. 


Do loop. “to” and “by” clauses specify incrementing an iteration variable; 
“while” and “until” clauses specify terminating conditions. Indenting 
indicates the scope of a loop. 


Leave innermost do loop or do loop specified in a leave statement. 
An instruction or register field 

A bit in a named instruction or register field 

A range of bits in a named instruction or register field 
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Pee 


REG[FLD] 


REG[FLD, FLD] 
REG[FLD:FLD] 


GPR(r) 
(GPR(n) 
DCR(DCRN) 


SPR(SPRN) 
TBR(TBRN) 


GPRs 
(Rx) 
(RA|O) 
CRetp 
Co:3 

"b 

XX 
CEIL(x) 
EXTS(x) 
PC 
RESERVE 


CIA 


NIA 


MS(adar, n) 


EA 


A list of bits, by number or name, in a named instruction or register field 
A bit in a named register 

A range of bits in a named register 

A list of bits, by number or name, in a named register 

A field in a named register 

A list of fields in a named register 

A range of fields in a named register 

General Purpose Register (GPR) r, where 0 <r < 31. 

The contents of GPR r, where O<r< 31. 


A Device Control Register (DCR) specified by the DCRF field in an 
mfdcer or mtder instruction 


An SPR specified by the SPRF field in an mfspr or mtspr instruction 


A Time Base Register (TBR) specified by the TBRF field in an mftb 
instruction 


RA, RB, 

The contents of a GPR, where xis A, B, S, or T 

The contents of the register RA or 0, if the RA field is 0. 

The field in the condition register pointed to by a field of an instruction. 
A 4-bit object used to store condition results in compare instructions. 
The bit or bit value b is replicated n times. 

Bit positions which are don’t-cares. 

Least integer > x. 

The result of extending x on the left with sign bits. 

Program counter. 


Reserve bit; indicates whether a process has reserved a block of 
storage. 


Current instruction address; the 32-bit address of the instruction being 
described by a sequence of pseudocode. This address is used to set the 
next instruction address (NIA). Does not correspond to any architected 
register. 


Next instruction address; the 32-bit address of the next instruction to be 
executed. In pseudocode, a successful branch is indicated by assigning 
a value to NIA. For instructions that do not branch, the NIA is CIA +4. 


The number of bytes represented by n at the location in main storage 
represented by adar. 


Effective address; the 32-bit address, derived by applying indexing or 
indirect addressing rules to the specified operand, that specifies a 
location in main storage. 
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EA, 
EAp:b 
ROTL((RS),n) 


MASK(MB,ME) 


instruction(EA) 


A bit in an effective address. 
A range of bits in an effective address. 


Rotate left; the contents of RS are shifted left the number of bits 
specified by n. 

Mask having 1s in positions MB through ME (wrapping if MB > ME) and 
Os elsewhere. 


An instruction operating on a data or instruction cache block associated 
with an EA. 
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Chapter 1. Overview 


The IBM 405 32-bit reduced instruction set computer (RISC) processor core, referred to as the 
PPC405 core, implements the PowerPC Architecture with extensions for embedded applications. 


This chapter describes: 
« PPC405 core features 
¢ The PowerPC Architecture 


* The PPC405 implementation of the IBM PowerPC Embedded Environment, an extension of the 
PowerPC Architecture for embedded applications 


« PPC405 organization, including a block diagram and descriptions of the functional units 
* PPC405 registers 
« PPC405 addressing modes 


1.1 PPC405 Features 


The PPC405 core provides high performance and low power consumption. The PPC405 RISC CPU 
executes at sustained speeds approaching one cycle per instruction. On-chip instruction and data 
caches arrays can be implemented to reduce chip count and design complexity in systems and 
improve system throughput. 


The PowerPC RISC fixed-point CPU features: 


¢ PowerPC User Instruction Set Architecture (UISA) and extensions for embedded applications 
¢ Thirty-two 32-bit general purpose registers (GPRs) 

¢ Static branch prediction 

¢ Five-stage pipeline with single-cycle execution of most instructions, including loads/stores 
¢ Unaligned load/store support to cache arrays, main memory, and on-chip memory (OCM) 
¢ Hardware multiply/divide for faster integer arithmetic (4-cycle multiply, 35-cycle divide) 

¢ Multiply-accumulate instructions 

¢ Enhanced string and multiple-word handling 

¢ True little endian operation 

¢ Programmable Interval Timer (PIT), Fixed Interval Timer (FIT), and watchdog timer 

¢ Forward and reverse trace from a trigger event 


¢ Storage control 


— Separate, configurable, two-way set-associative instruction and data cache units; for the 
PPC405B3, the instruction cache array is 16KB and the data cache array is 8KB 


— Eight words (82 bytes) per cache line 


— Support for any combination of OKB, 4KB, 8KB, and 16KB, and 32KB instruction and data cache 
arrays, depending on model 
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Instruction cache unit (ICU) non-blocking during line fills, data cache unit (DCU) non-blocking 
during line fills and flushes 


Read and write line buffers 


— Instruction fetch hits are supplied from line buffer 


Data load/store hits are supplied to line buffer 
— Programmable ICU prefetching of next sequential line into line buffer 


— Programmable ICU prefetching of non-cacheable instructions, full line (eight words) or half line 
(four words) 


— Write-back or write-through DCU write strategies 
— Programmable allocation on loads and stores 
— Operand forwarding during cache line fills 

* Memory Management 


— Translation of the 4GB logical address space into physical addresses 
Independent enabling of instruction and data translation/protection 
Page level access control using the translation mechanism 

Software control of page replacement strategy 

Additional control over protection using zones 


WIUOGE (write-through, cachability, compresseduser-defined 0, guarded, endian) storage 
attribute control for each virtual memory region 


¢ WIUOGE storage attribute control for thirty-two real 128MB regions in real mode 
¢ Support for OCM that provides memory access performance identical to cache hits 


¢ Full PowerPC floating-point unit (FPU) support using the auxiliary processor unit (APU) interface 
(the PPC405 does not include an FPU) 


¢ PowerPC timer facilities 


— 64-bit time base 
— PIT, FIT, and watchdog timers 
— Synchronous external time base clock input 


* Debug Support 


— Enhanced debug support with logical operators 


Four instruction address compares (IACs) 


Two data address compares (DACs) 


Two data value compares (DVCs) 
JTAG instruction to write to ICU 


— Forward or backward instruction tracing 
¢ Minimized interrupt latency 


« Advanced power management support 
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1.2 PowerPC Architecture 


The PowerPC Architecture comprises three levels of standards: 


¢ PowerPC User Instruction Set Architecture (UISA), including the base user-level instruction set, 
user-level registers, programming model, data types, and addressing modes. This is referred to as 
Book | of the PowerPC Architecture. 


¢ PowerPC Virtual Environment Architecture, describing the memory model, cache model, cache- 
control instructions, address aliasing, and related issues. While accessible from the user level, 
these features are intended to be accessed from within library routines provided by the system 
software. This is referred to as Book II of the PowerPC Architecture. 


¢ PowerPC Operating Environment Architecture, including the memory management model, 
supervisor-level registers, and the exception model. These features are not accessible from the 
user level. This is referred to as Book III of the PowerPC Architecture. 


Book | and Book II define the instruction set and facilities available to the application programmer. 
Book III defines features, such as system-level instructions, that are not directly accessible by user 
applications. The PowerPC Architecture is described in The PowerPC Architecture: A Specification 
for a New Family of RISC Processors. 


The PowerPC Architecture provides compatibility of PowerPC Book | application code across all 
PowerPC implementations to help maximize the portability of applications developed for PowerPC 
processors. This is accomplished through compliance with the first level of the architectural definition, 
the PowerPC UISA, which is common to all PowerPC implementations. 


1.3. The PPC405 as a PowerPC Implementation 


The PPC405 implements the PowerPC UISA, user-level registers, programming model, data types, 
addressing modes, and 32-bit fixed-point operations. The PPC405 fully complies with the PowerPC 
UISA. The UISA 64-bit operations are not implemented, nor are the floating point operations, unless a 
floating point unit (FPU) is implemented. The floating point operations, which cause exceptions, can 
then be emulated by software. 


Most of the features of the PPC405 are compatible with the PowerPC Virtual Environment and 
Operating Environment Architectures, as implemented in PowerPC processors such as the 

6xx/7xx family. The PPC405 also provides a number of optimizations and extensions to these layers 
of the PowerPC Architecture. The full architecture of the PPC405 is defined by the PowerPC 
Embedded Environment and the PowerPC User Instruction Set Architecture. 


The primary extensions of the PowerPC Architecture defined in the Embedded Environment are: 


¢ Asimplified memory management mechanism with enhancements for embedded applications 
¢ Anenhanced, dual-level interrupt structure 

« An architected DCR address space for integrated peripheral control 

¢ The addition of several instructions to support these modified and extended resources 

Finally, some of the specific implementation features of the PPC405 are beyond the scope of the 


PowerPC Architecture. These features are included to enhance performance, integrate functionality, 
and reduce system complexity in embedded control applications. 
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1.4 Processor Core Organization 


The processor core consists of a 5-stage pipeline, separate instruction and data cache units, virtual 
memory management unit (MMU), three timers, debug, and interfaces to other functions. 


Figure 1-1 illustrates the logical organization of the PPC405. 


PLB Master Instruction 
Interface OCM 


i MMU 405 CPU ; 
Timers 


I-Cache . I-Cache 
Array _, Controller 


Ae I oe ete Instruction Shadow 


(FIT, 


Instruction 


Cache (4 Entry) 
Unit 
Timers 
& 
Cache Units Unified TLB 
(64 Entry) Debug 


Debug Logic 


(4 IAC, 
2 DAC, 
2 DVC) 


Data Shadow Execute Unit (EXU) 


TLB 


D-Cache, D-Cache (8 Entry) 


Array ' Controller 
I 


PLB Master Data APU/FPU JTAG _ Instruction 
Interface OCM Trace 


Figure 1-1. PPC405 Block Diagram 


1.4.1. Instruction and Data Cache Controllers 


The instruction cache unit (ICU) and data cache unit (DCU) enable concurrent accesses and 
minimize pipeline stalls. The storage capacity of the cache units, which can range from OKB-32KB, 
depends upon the implementation. Both cache units are two-way set-associative, use a 32-byte line 
size. The instruction set provides a rich assortment of cache control instructions, including 
instructions to read tag information and data arrays. See Chapter 4, “Cache Operations,” for detailed 
information about the ICU and DCU. 


The cache units are PLB-compliant for use in the IBM Core+ASIC program. 


1.4.1.1. Instruction Cache Unit 


The ICU provides one or two instructions per cycle to the execution unit (EXU) over a 64-bit bus. A 
line buffer (built into the output of the array for manufacturing test) enables the ICU to be accessed 
only once for every four instructions, to reduce power consumption by the array. 


The ICU can forward any or all of the words of a line fill to the EXU to minimize pipeline stalls caused 
by cache misses. The ICU aborts speculative fetches abandoned by the EXU, eliminating 
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unnecessary line fills and enabling the ICU to handle the next EXU fetch. Aborting abandoned 
requests also eliminates unnecessary external bus activity to increase external bus utilization. 


1.4.1.2 Data Cache Unit 


The DCU transfers 1, 2, 3, 4, or 8 bytes per cycle, depending on the number of byte enables 
presented by the CPU. The DCU contains a single-element command and store data queue to reduce 
pipeline stalls; this queue enables the DCU to independently process load/store and cache control 
instructions. Dynamic PLB request prioritization reduces pipeline stalls even further. When the DCU is 
busy with a low-priority request while a subsequent storage operation requested by the CPU is 
stalled, the DCU automatically increases the priority of the current request to the PLB. 


The DCU uses a two-line flush queue to minimize pipeline stalls caused by cache misses. Line 
flushes are postponed until after a line fill is completed. Registers comprise the first position of the 
flush queue; the line buffer built into the output of the array for manufacturing test serves as the 
second position of the flush queue. Pipeline stalls are further reduced by forwarding the requested 
word to the CPU during the line fill. Single-queued flushes are non-blocking. When a flush operation 
is pending, the DCU can continue to access the array to determine subsequent load or store hits. 
Under these conditions, load hits can occur concurrently with store hits to write-back memory without 
stalling the pipeline. Requests abandoned by the CPU can also be aborted by the cache controller. 


Additional DCU features enable the programmer to tailor performance for a given application. The 
DCU can function in write-back or write-through mode, as controlled by the Data Cache Write-through 
Register (DCWR) or the translation look-aside buffer (TLB). DCU performance can be tuned to 
balance performance and memory coherency. Store-without-allocate, controlled by the SWOA field of 
the Core Configuration Register 0 (CCRO), can inhibit line fills caused by store misses to further 
reduce potential pipeline stalls and unwanted external bus traffic. Similarly, load-without-allocate, 
controlled by CCRO[LWOA], can inhibit line fills caused by load misses. 


1.4.2 Memory Management Unit 
The 4GB address space of the PPC405 is presented as a flat address space. 


The MMU provides address translation, protection functions, and storage attribute control for 
embeddedembedded applications. The MMU supports demand paged virtual memory and other 
management schemes that require precise control of logical to physical address mapping and flexible 
memory protection. Working with appropriate system level software, the MMU provides the following 
functions: 

¢ Translation of the 4GB logical address space into physical addresses 

¢ Independent enabling of instruction and data translation/protection 

« Page level access control using the translation mechanism 

¢ Software control of page replacement strategy 

¢ Additional control over protection using zones 

¢ Storage attributes for cache policy and speculative memory access control 


The MMU can be disabled under software control. If the MMU is not used, the PPC405 core provides 
other storage control mechanisms. 


The translation lookaside buffer (TLB) is the hardware resource that controls translation and 
protection. It consists of 64 entries, each specifying a page to be translated. The TLB is fully 
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associative; a page entry can be placed anywhere in the TLB. The translation function of the MMU 
occurs pre-cache for data accesses. Cache tags and indexing use physical addresses for data 
accesses; instruction fetches are virtually indexed and physically tagged. 


Software manages the establishment and replacement of TLB entries. This gives system software 
significant flexibility in implementing a custom page replacement strategy. For example, to reduce 
TLB thrashing or translation delays, software can reserve several TLB entries for globally accessible 
static mappings. The instruction set provides several instructions to manage TLB entries. These 
instructions are privileged and require the software to be executing in supervisor state. Additional TLB 
instructions are provided to move TLB entry fields to and from GPRs. 


The MMU divides logical storage into pages. Eight page sizes (1KB, 4KB, 16KB, 64KB, 256KB, 1MB, 
4MB, 16MB) are simultaneously supported, so that, at any given time, the TLB can contain entries for 
any combination of page sizes. For a logical to physical translation to occur, a valid entry for the page 
containing the logical address must be in the TLB. Addresses for which no TLB entry exists cause 
TLB-Miss exceptions. 


To improve performance, 4 instruction-side and 8 data-side TLB entries are kept in shadow arrays. 
The shadow arrays prevent TLB contention. Hardware manages the replacement and invalidation of 
shadow-TLB entries; no system software action is required. The shadow arrays can be thought of as 
level 1 TLBs, with the main TLB serving as a level 2 TLB. 


When address translation is enabled, the translation mechanism provides a basic level of protection. 
Physical addresses not mapped by a page entry are inaccessible when translation is enabled. Read 
access is implied by the existence of the valid entry in the TLB. The EX and WR bits in the TLB entry 
further define levels of access for the page, by permitting execute and write access, respectively. 


The Zone Protection Register (ZPR) enables the system software to override the TLB access 
controls. For example, the ZPR provides a way to deny read access to application programs. The 
ZPR can be used to classify storage by type; access by type can be changed without manipulating 
individual TLB entries. 


The PowerPC Architecture provides WIUOGE (write-back/write through, cachability, user-defined 0, 
guarded, endian) storage attributes that control memory accesses, using bits in the TLB or, when 
address translation is disabled, storage attribute control registers. 


When address translation is enabled (MSR[IR, DR] = 1), storage attribute control bits in the TLB 
control the storage attributes associated with the current page. When address translation is disabled 
(MSR[IR, DR] = 0), bits in each storage attribute control register control the storage attributes 
associated with storage regions. Each storage attribute control register contains 32 fields. Each field 
sets the associated storage attribute for a 128MB memory region. See “Real-Mode Storage Attribute 
Control” on page 7-17 for more information about the storage attribute control registers. 


1.4.3 Timer Facilities 


The processor core contains a time base and three timers: 


¢ Programmable Interval Timer (PIT) 
¢ Fixed Interval Timer (FIT) 
¢ Watchdog timer 
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The time base is a 64-bit counter incremented either by an internal signal equal to the CPU clock rate 
or by a separate external timer clock signal. No interrupts are generated when the time base rolls 
over. 


The PIT is a 32-bit register that is decremented at the same rate as the time base is incremented. The 
user loads the PIT register with a value to create the desired delay. When a decrement occurs on a 
PIT count of 1, the timer stops decrementing, a bit is set in the Timer Status Register (TSR), anda 
PIT interrupt is generated. Optionally, the PIT can be programmed to reload automatically the last 
value written to the PIT register, after which the PIT begins decrementing again. The Timer Control 
Register (TCR) contains the interrupt enable for the PIT interrupt. 


The FIT generates periodic interrupts based on selected bits in the time base. Users can select one of 
four intervals for the timer period by setting the appropriate bits in the TCR. When the selected bit in 
the time base changes from 0 to 1, a bit is set in the TSR and a FIT interrupt is generated. The FIT 
interrupt enable is contained in the TCR. 


The watchdog timer generates a periodic interrupt based on selected bits in the time base. Users can 
select one of four time periods for the interval and the type of reset generated if the watchdog timer 
expires twice without an intervening clear from software. 


1.4.4 Debug 


The processor core debug facilities include debug modes for the various types of debugging used 
during hardware and software development. Also included are debug events that allow developers to 
control the debug process. Debug modes and debug events are controlled using debug registers in 
the chip. The debug registers are accessed either through software running on the processor, or 
through the JTAG port. The JTAG port can also be used for board test. 


The debug modes, events, controls, and interfaces provide a powerful combination of debug facilities 
for hardware and software development tools. 


1.4.4.1 Development Tool Support 
The PPC405 supports a wide range of hardware and software development tools. 


An operating system debugger is an example of an operating system-aware debugger, implemented 
using software traps. 


RISCWatch is an example of a development tool that uses the external debug mode, debug events, 
and the JTAG port to support hardware and software development and debugging. 


The RlSCTrace™ feature of RISCWatch is an example of a development tool that uses the real-time 
trace capability of the processor core. 


1.4.4.2 Debug Modes 


The internal, external,real-time-trace, and debug wait modes support a variety of debug tool used in 
embedded systems development. These debug modes are described in detail in “Debug Modes” on 
page 8-1. 

1.4.5 Core Interfaces 


The core provides a range of I/O interfaces that simplify the attachment of on-chip and off-chip 
devices. 
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1.4.5.1. Processor Local Bus 


The PLB-compliant interface provides separate 32-bit address and 64-bit data buses for the 
instruction and data sides. 


1.4.5.2 Device Control Register Bus 


The Device Control Register (DCR) bus supports the attachment of on-chip registers for device 
control. 


These registers are accessed using the mfder and mtdcr instructions. 


1.4.5.3 Clock and Power Management 


This interface supports several methods of clock distribution and power management. 


1.4.5.4 JTAG 


The JTAG port is enhanced to support the attachment of a debug tool such as the RISCWatch 
product from IBM Microelectronics. Through the JTAG test access port, a debug tool can single-step 
the processor and interrogate internal processor state to facilitate software debugging. The 
enhancements comply with the IEEE 1149.1 specification for vendor-specific extensions, and are 
therefore compatible with standard JTAG hardware for boundary-scan system testing. 


1.4.5.5 Interrupts 


The processor core provides an interface to an on-chip interrupt controller that is logically outside the 
core. The interrupt controller combines asynchronous interrupt inputs from on-chip and off-chip 
sources and presents them to the core using a pair of interrupt signals: critical and non-critical. The 
sources of asynchronous interrupts are external signals, the JTAG/debug unit, and any implemented 
peripherals. 


1.4.5.6 Auxiliary Processor Unit 


The auxiliary processor unit (APU) interface supports the attachment of auxiliary processor hardware 
and the implementation of the associated instructions for improved performance in specialized 
applications. 


1.4.5.7 On-Chip Memory 

The on-chip memory (OCM) interface supports the implementation of instruction- and data-side 
memory that can be accessed at performance levels matching the cache arrays. 

1.4.6 Data Types 


Processor core operands are bytes, halfwords, and words. Multiple words or strings of bytes can be 
transferred using the load/store multiple and load/store string instructions. Data is represented in twos 
complement notation or in unsigned fixed-point format. 


The address of a multibyte operand is always the lowest memory address occupied by that operand. 
Byte ordering can be selected as big endian (the lowest memory address of an operand contains its 
most significant byte) or as little endian (the lowest memory address of an operand contains its least 
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significant byte). See “Byte Ordering” on page 2-17 for more information about big and little endian 
operation. 


1.4.7. Processor Core Register Set Summary 


The processor core registers can be grouped into basic categories based on function and access 
mode: general purpose registers (GPRs), special purpose registers (SPRs), the machine state 
register (MSR), the condition register (CR), and, in Core+ASIC implementations, device control 
registers (DCRs). 


Chapter 10, “Register Summary,” provides a register diagram and a register field description table for 
each register. 


1.4.7.1 General Purpose Registers 


The processor core contains 32 GPRs; each register contains 32 bits. The contents of the GPRs can 
be transferred from memory using load instructions and stored to memory using store instructions. 
GPRs, which are specified as operands in many instructions, can also receive instruction results and 
the contents of other registers. 


1.4.7.2 Special Purpose Registers 


Special Purpose Registers (SPRs), which are part of the PowerPC Architecture, are accessed using 
the mtspr and mfspr instructions. SPRs control the use of the debug facilities, timers, interrupts, 
storage control attributes, and other architected processor resources. 


All SPRs are privileged (unavailable to user-mode programs), except the Count Register (CTR), the 
Link Register (LR), SPR General Purpose Registers (SPRG4—SPRG7, read-only), and the Fixed- 
point Exception Register (XER). Note that access to the Time Base Lower (TBL) and Time Base 
Upper (TBU) registers, when addressed as SPRs, is write-only and privileged. However, when 
addressed as Time Base Registers (TBRs), read access to these registers is not privileged. See 
“Time Base Registers” on page 10-4 for more information. 


1.4.7.3. Machine State Register 


The PPC405 contains a 32-bit Machine State Register (MSR). The contents of a GPR can be written 
to the MSR using the mtmsr instruction, and the MSR contents can be read into a GPR using the 
mfmsr instruction. The MSR contains fields that control the operation of the processor core. 


1.4.7.4 Condition Register 


The PPC405 contains a 32-bit Condition Register (CR). These bits are grouped into eight 4-bit fields, 
CR[CRO]—CR[CR7]. Instructions are provided to perform logical operations on CR fields and bits 
within fields and to test CR bits within fields. The CR fields, which are set by compare instructions, 
can be used to control branches. CR[CRO] can be set implicitly by arithmetic instructions. 


1.4.7.5 Device Control Registers 


DCRs, which are architecturally outside of the processor core, are accessed using the mtdcr and 
mfdcr instructions. DCRs are used to control, configure, and hold status for various functional units 
that are not part of the processor core. Although the PPC405 does not contain DCRs, the mtdcr and 
mfdcr instructions are provided. 
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The mtder and mfdcr instructions are privileged, for all DCRs. Therefore, all accesses to DCRs are 
privileged. See “Privileged Mode Operation” on page 2-30. 


All DCR numbers are reserved, and should be neither read nor written, unless they are part of an IBM 
Core+ASIC implementation. 


1.4.8 Addressing Modes 


The processor core supports the following addressing modes, which enable efficient retrieval and 
storage of data in memory: 


* Base plus displacement addressing 
¢ Indexed addressing 
¢ Base plus displacement addressing and indexed addressing, with update 


In the base plus displacement addressing mode, an effective address (EA) is formed by adding a 
displacement to a base address contained in a GPR (or to an implied base of 0). The displacement is 
an immediate field in an instruction. 


In the indexed addressing mode, the EA is formed by adding an index contained in a GPR to a base 
address contained in a GPR (or to an implied base of 0). 


The base plus displacement and the indexed addressing modes also have a “with update” mode. In 
“with update” mode, the effective address calculated for the current operation is saved in the base 
GPR, and can be used as the base in the next operation. The “with update” mode relieves the 
processor from repeatedly loading a GPR with an address for each piece of data, regardless of the 
proximity of the data in memory. 
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Chapter 2. Programming Model 


The programming model of the PPC405 embedded processor core describes the following features 
and operations: 


* Memory organization and addressing, starting on page 2-1 
¢ Registers, starting on page 2-2 

* Data types and alignment, starting on page 2-16 

¢ Byte ordering, starting on page 2-17 

¢ Instruction processing, starting on page 2-23 

¢ Branching control, starting on page 2-24 

¢ Speculative accesses, starting on page 2-27 

¢ Privileged mode operation, starting on page 2-30 

¢ Synchronization, starting on page 2-33 


¢ Instruction set, starting on page 2-36 


2.1. User and Privileged Programming Models 


The PPC405 executes programs in two modes, also referred to as states. Programs running in 
privileged mode (also referred to as the supervisor state) can access any register and execute any 
instruction. These instructions and registers comprise the privileged programming model. In user 
mode, certain registers and instructions are unavailable to programs. This is also called the problem 
state. Those registers and instructions that are available comprise the user programming model. 


Privileged mode provides operating system software access to all processor resources. Because 
access to certain processor resources is denied in user mode, application software runs in user 
mode. Operating system software and other application software is protected from the effects of an 
errant application program. 


Throughout this book, the terms user program and privileged programs are used to associate 
programs with one of the programming models. Registers and instructions are described as user or 
privileged. Privileged mode operation is described in detail in “Privileged Mode Operation” on 

page 2-30. 


2.2 Memory Organization and Addressing 


The PowerPC Architecture defines a 32-bit, 4-gigabyte (GB) flat address space for instructions and 
data 


User’s manuals for standard products containing a PPC405 core describe the memory organizations 
and physical address maps of the standard products. 
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2.2.1. Storage Attributes 


The PowerPC Architecture defines storage attributes that control data and instruction accesses. 
Storage attributes are provided to control cache write-through policy (the W storage attribute), 
cachability (the | storage attribute), memory coherency in multiprocessor environments (the M 
storage attribute), and guarding against speculative memory accesses (the G storage attribute). The 
IBM PowerPC Embedded Environment defines additional storage attributes for storage compression 
(the U0 storage attribute) and byte ordering (the E storage attribute). 


The PPC405 core provides two control mechanisms for the W, I, U0, G, and E attributes. Because the 
PPC405 core does not provide hardware support for multiprocessor environments, the M storage 
attribute, when present, has no effect. 


When the PPC405 core operates in virtual mode (address translation is enabled), each storage 
attribute is controlled by the W, I, UO, G, and E fields in the translation lookaside buffer (TLB) entry for 
each memory page. The size of memory pages, and hence the size of storage attribute control 
regions, is variable. Multiple sizes can be in effect simultaneously on different pages. 


When the PPC405 core operates in real mode (address translation is disabled), storage attribute 
control registers control the corresponding storage attributes. These registers are: 


¢ Data Cache Write-through Register (DCWR) 
¢ Data Cache Cachability Register (DCCR) 

¢ Instruction Cache Cachability Register (ICCR) 
¢ Storage Guarded Register (SGR) 

¢ Storage Little-Endian Register (SLER) 

* Storage User-defined 0 Register (SUOR) 


Each storage attribute control register contains 32 bits; each bit controls one of thirty-two 128MB 
storage attribute control regions. Bit 0 of each register controls the lowest-order region, with 
ascending bits controlling ascending regions in memory. The storage attributes in each storage 
attribute region are set independently of each other and of the storage attributes for other regions. 


2.3 Registers 


All PPC405 registers are listed in this section. Some of the frequently-used registers are described in 
detail. Other registers are covered in their respective topic chapters (for example, the cache registers 
are described in Chapter 4, “Cache Operations”). All registers are summarized in Chapter 10, 
“Register Summary.” 


The registers are grouped into categories: General Purpose Registers (GPRs), Special Purpose 
Registers (SPRs), Time Base Registers (TBRs), the Machine State Register (MSR), the Condition 
Register (CR), and, in standard products, Device Control Registers (DCRs). Different instructions are 
used to access each category of registers. 


For all registers with fields marked as reserved, the reserved fields should be written as 0 and read as 
undefined. That is, when writing to a register with a reserved field, write a 0 to the reserved field. 
When reading from a register with a reserved field, ignore that field. 


2-2 PPC405 Core User’s Manual 


Programming Note: A good coding practice is to perform the initial write to a register with 


reserved fields as described, and to perform all subsequent writes to the register using a read- 


modify-write strategy: read the register, use logical instructions to alter defined fields, leaving 
reserved fields unmodified, and write the register. 


Figure 2-1 on page 2-4 illustrates the registers in the user and supervisor programming models. 


Programming Model 


2-3 


2-4 


User Model 


General-Purpose Registers 


GPRO 
GPR1 


GPR31 


SPR General Registers (read-only) 
SPR 0x104 
SPR 0x105 
SPR 0x106 
SPR 0x107 


User SPR General Register 0 (read/write) 


USPRGO SPR 0x100 


Condition Register 


R 


Fixed-Point Exception Register 


XER SPR 0x001 


Link Register 
LR SPR 0x008 


Count Register 


CTR SPR 0x009 


Time Base Registers (read-only) 
TBL TBR 0x10C 


TBU TBR 0x10D 


Storage Attribute Control Registers 


DCCR SPR 0x3FA 


DCWR SPR 0x3BA 


ICCR SPR 0x3FB 


SGR SPR 0x3B9 


SLER SPR 0x3BB 


SUOR SPR 0x3BC 


Supervisor Model 


Machine State Register 
MSR 
Core Configuration Register 


CCRO SPR 0x3B3 


SPR General Registers 
SPR 0x110 
SPR 0x111 
SPR 0x112 
SPR 0x113 
SPR 0x114 
SPR 0x115 
SPR 0x116 
SPR 0x117 


Exception Handling Registers 
Exception Vector Prefix Register 


EVPR 


SPR 0x3D5 


Exception Syndrome Register 


ESR 


SPR 0x3D4 


Data Exception Address Register 


DEAR 


SPR 0x3D5 


Save/Restore Registers 


SRRO SPR Ox01A 


SRR1 SPR 0x01B 


SRR2 SPR 0x3DE 


SRR3 SPR 0x3DF 


Memory Management Registers 
Process ID 


Zone Protection Register 


ZPR 


SPR 0x3B1 


SPR 0x3B0 


Processor Version Register 


PVR SPR 0x11F 


Timer Facilities 
Time Base Registers 


TBL SPR 0x11C 


SPR 0x11D 


Tim ister 


SPR 0x3DA 


ister 


SPR 0x3D8 


Programmable Interval Timer 


PIT SPR 0x3DB 


Debug Registers 
Debug Status Register 


DBSR SPR 0x3F0 


Debug Control Registers 
DBCRO SPR 0x3F2 


DBCR1 SPR 0x3BD 


Data Address Compares 


DAC1 SPR Ox3F6 


DAC2 SPR 0x3F7 


Data Value Compares 
DVC1 SPR 0x3B6 


DVC2 SPR 0x3B7 


Instruction Address Compares 

SPR 0x3F4 
SPR 0x3F5 
SPR 0x3B4 
SPR 0x3B5 


Instruction Cache Debug Data Register 


ICDBR SPR 0x3D3 


Figure 2-1. PPC405 Programming Model—Registers 
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2.3.1. General Purpose Registers (RO-R31) 


The PPC405 core contains thirty-two 32-bit general purpose registers (GPRs). Data from memory 
can be read into GPRs using load instructions and the contents of GPRs can be written to memory 
using store instructions. Most integer instructions use GPRs for source and destination operands. 
See Table 10, “Register Summary,’ on page 10-1 for the numbering of the GPRs. 


Figure 2-2. General Purpose Registers (RO-R31) 


0:31 General Purpose Register data 


2.3.2 Special Purpose Registers 


Special purpose registers (SPRs), which are part of the PowerPC Architecture and the IBM PowerPC 
Embedded Environment, are accessed using the mtspr and mfspr instructions. 


SPRs control the operation of debug facilities, timers, interrupts, storage control attributes, and other 
architected processor resources. Table 10, “Register Summary,’ on page 10-1 shows the mnemonic, 
name, and number for each SPR. Table 2-1, “PPC405 SPRs,’ on page 2-6 lists the PPC405 SPRs by 
function and indicates the pages where the SPRs are described more fully. 


Except for the Link Register (LR), the Count Register (CTR), the Fixed-point Exception Register 
(XER), User SPR General 0 (USPRGO, and read access to SPR General 4—7 (SPRG4—SPRG7), all 
SPRs are privileged. As SPRs, the registers TBL and TBU are privileged write-only; as TBRs, these 
registers can be read in user mode. Unless used to access non-privileged SPRs, attempts to execute 
mfspr and mtspr instructions while in user mode cause privileged violation program interrupts. See 
“Privileged SPRs’” on page 2-32. 
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Table 2-1. PPC405 SPRs 


Function Register Access Page 
Configuration |CCRO Privileged 4-11 

Branch Control cals meee ee 

LR User 2-7 

DAC1 DAC2 Privileged 8-9 

DBCRO |DBCRI1 Privileged 8-4 

Debug | DBSR Privileged 8-7 

DVC1 DVC2 Privileged 8-10 

IAC1 IAC2 IAC3 IAC4 Privileged 8-9 

ICDBDR Privileged 4-14 

Fixed-point Exception | XER User 2-7 
SPRGO |SPRG1 |SPRG2 |SPRG3 | Privileged 2-9 

General-Purpose SPR |SPRG4 |SPRG5 |SPRG6 |SPRG7 | User read, privileged write 2-9 
USPRGO User 2-9 

DEAR Privileged 5-13 

ESR Privileged 5-11 

Interrupts and Exceptions |EVPR Privileged 5-10 
SRRO SRR1 Privileged 5-9 

SRR2 SRR3 Privileged 5-9 

Processor Version PVR Privileged, read-only 2-10 
DCCR Privileged 7-17 

DCWR Privileged 7-17 

Storage Attribute Control noe clea ee 
SGR Privileged 7-17 

SLER Privileged 7-17 

SUOR Privileged 7-17 

TBL TBU Privileged, write-only 6-1 

Timer Facilities a peace es 

TCR Privileged 6-9 

TSR Privileged 6-8 

Zone Protection | ZPR Privileged 7-14 


2.3.2.1. Count Register (CTR) 


The CTR is written from a GPR using mtspr. The CTR contents can be used as a loop count that is 
decremented and tested by some branch instructions. Alternatively, the CTR contents can specify a 
target address for the bectr instruction, enabling branching to any address. 


The CTR is in the user programming model. 
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Figure 2-3. Count Register (CTR) 


0:31 Count Used as count for branch conditional with 
decrement instructions, or as address for 
branch-to-counter instructions. 


2.3.2.2 Link Register (LR) 


The LR is written from a GPR using mtspr, and by branch instructions that have the LK bit set to 1. 
Such branch instructions load the LR with the address of the instruction following the branch 
instruction. Thus, the LR contents can be used as the return address for a subroutine that was called 
using the branch. 


The LR contents can be used as a target address for the belr instruction. This allows branching to any 
address. 


When the LR contents represent an instruction address, LR39-3, are assumed to be 0, because all 
instructions must be word-aligned. However, when LR is read using mfspr, all 32 bits are returned as 
written. 


The LR is in the user programming model. 


Figure 2-4. Link Register (LR) 


0:31 Link Register contents If (LR) represents an instruction address, 
LR39-31 should be 0. 


2.3.2.3 Fixed Point Exception Register (XER) 
The XER records overflow and carry conditions generated by integer arithmetic instructions. 


The Summary Overflow (SO) field is set to 1 when instructions cause the Overflow (OV) field to be set 
to 1. The SO field does not necessarily indicate that an overflow occurred on the most recent 
arithmetic operation, but that an overflow occurred since the last clearing of XER[SO]. mtspr(XER) 
sets XER[SO, OV] to the value of bit positions 0 and 1 in the source register, respectively. 
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Once set, XER[SO] is not reset until an mtspr(XER) is executed with data that explicitly puts a 0 in 
the SO bit, or until an merxr instruction is executed. 


XER[OV] is set to indicate whether an instruction that updates XER[OV] produces a result that 
“overflows” the 32-bit target register. XER[OV] = 1 indicates overflow. For arithmetic operations, this 
occurs when an operation has a carry-in to the most-significant bit of the result that does not equal 
the carry-out of the most-significant bit (that is, the exclusive-or of the carry-in and the carry-out is 1). 


The following instructions set XER[OV] differently. The specific behavior is indicated in the instruction 
descriptions in Chapter 9, “Instruction Set.” 


¢ Move instructions: 
merxr, mtspr(XER) 
¢ Multiply and divide instructions: 
mullwo, mullwo., divwo, divwo., divwuo, divwuo 


The Carry (CA) field is set to indicate whether an instruction that updates XER[CA] produces a result 
that has a carry-out of the most-significant bit. XER[CA] = 1 indicates a carry. 


The following instructions set XER[CA] differently. The specific behavior is indicated in the instruction 
descriptions in Chapter 9, “Instruction Set.” 


* Move instructions 
merxr, mtspr(XER) 
¢ Shift-algebraic operations 
sraw, srawi 
The Transfer Byte Count (TBC) field is the byte count for load/store string instructions. 


The XER is part of the user programming model. 


SO CA TBC 
+ 4 t 
0}1/2/3 24) 25 31 


Figure 2-5. Fixed Point Exception Register (XER) 


0 SO Summary Overflow Can be set by mtspr or by using “o” form 
0 No overflow has occurred. instructions; can be reset by mtspr or by 
1 Overflow has occurred. merxr. 
1 OV Overflow Can be set by mtspr or by using “o” form 
0 No overflow has occurred. instructions; can be reset by mtspr, by 
0 Overflow has occurred. merxr, or “o” form instructions. 
2 CA Carry Can be set by mtspr or arithmetic 
0 Carry has not occurred. instructions that update the CA field; can 
1 Carry has occurred. be reset by mtspr, by merxr, or by 
arithmetic instructions that update the CA 
field. 
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3:24 
25:31 


Reserved 


TBC Transfer Byte Count Used by Iswx and stswx; written by mtspr. 


Table 2-2 and Table 2-3 list the PPC405 instructions that update the XER. In the tables, the syntax 
“[o]” indicates that the instruction has an “o” form that updates XER[SO,OV], and a “non-o” form. The 
syntax “[.]” indicates that the instruction has a “record” form that updates CR[CRO] (see “Condition 
Register (CR)” on page 2-10), and a “non-record” form. 


Table 2-2. XER[CA] Updating Instructions 


Integer Processor 
Integer Arithmetic Shift Control 
Shift 
Right Register 


Add Subtract 


Algebraic | Management 


addc[o][.] | subfc[ol][.] | sraw/[.] mtspr 
adde[o][.] | subfe[o][.] | srawi[.] merxr 
addic[.] subfic 
addmef[o][.] | subfmefo][.] 
addze[o][.] | subfzefo][.] 
Table 2-3. XER[SO,OV] Updating Instructions 
Processor 
Integer Arithmetic Auxiliary Processor Control 
Negative 
Multiply- Multiply- Register 
Add Subtract | Multiply | Divide Accumulate | Accumulate | Management 
addo[.] subfo[.] mullwo[.] | divwo[.] | nego[.] macchwof.] nmacchwo[.] | mtspr 
addco[.] subfco[.] divwuo[.] macchwso[.] | nmacchwso[.] | merxr 
addeo[.] | subfeo[.] macchwsuo[.] | nmachhwo[.] 
addmeo[.] | subfmeo[.] macchwuo[.] | nmachhwso[.] 
addzeo[.] | subfzeo[.] machhwo[.] nmaclhwo[.] 
machhwso[.]_ | nmaclhwso[.] 
machhwsuo[.] 
machhwuo[.] 
maclhwo[.] 
maclhwso[.] 
maclhwsuo[.] 
maclhwuo[.] 


2.3.2.4 Special Purpose Register General (SPRGO-SPRG7) 


USPRGO and SPRGO-SPRG7 are provided for general purpose software use. For example, these 
registers are used as temporary storage locations. For example, an interrupt handler might save the 
contents of a GPR to an SPRG, and later restore the GPR from it. This is faster than a save/restore to 
a memory location. These registers are written using mtspr and read using mfspr. 


Access to USPRGO is non-privileged for both read and write. 
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SPRGO-SPRG7 provide temporary storage locations. For example, an interrupt handler might save 
the contents of a GPR to an SPRG, and later restore the GPR from it. This is faster than performing a 
save/restore to memory. These registers are written by mtspr and read by mfspr. 


Access to SPRGO-SPRG7 is privileged, except for read access to SPRG4—SPRG7. See “Privileged 
SPRs” on page 2-32 for more information. 


Figure 2-6. Special Purpose Register General (SPRGO—SPRG7) 


0:31 General data Software value; no hardware usage. 


2.3.2.5 Processor Version Register (PVR) 


The PVR is a read-only register that uniquely identifies a standard product or Core+ASIC 
implementation. Software can examine the PVR to recognize implementation-dependent features and 
determine available hardware resources. 


Access to the PVR is privileged. See “Privileged SPRs” on page 2-32 for more information. 


OWN CAS AID 


t t ‘ 


0 11) 12 15) 16 21/22 25] 26 31 


i) 


UDEF PCL 


Figure 2-7. Processor Version Register (PVR) 


0:11 OWN | Owner Identifier Identifies the owner of a core 

12:15 | PCF Processor Core Family Identifies the processor core family. 

16:21 | CAS Cache Array Sizes Identifies the cache array sizes. 

22:25 | PCL Processor Core Version Identifies the core version for a specific 
combination of PVR[PCF] and PVR[CAS] 

26:31 | AID ASIC Identifier Assigned sequentially; identifies an ASIC 
function, version, and technology 


2.3.3 Condition Register (CR) 


The CR contains eight 4-bit fields (CRO—CR7), as shown in Figure 3-8. The fields contain conditions 
detected during the execution of integer or logical compare instructions, as indicated in the instruction 
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descriptions in Chapter 9, “Instruction Set.” The CR contents can be used in conditional branch 
instructions. 


The CR can be modified in any of the following ways: 


mtcrf sets specified CR fields by writing to the CR from a GPR, under control of a mask specified 
as an instruction field. 


merf sets a specified CR field by copying another CR field to it. 


merxr copies certain bits of the XER into a designated CR field, and then clears the corresponding 
XER bits. 


The “with update” forms of integer instructions implicitly update CR[CRO]. 
Integer compare instructions update a specified CR field. 


Auxiliary processor instructions can update a specified CR field (including the implicit update of 
CR[CR1] by certain floating-point operations). 


The CR-logical instructions update a specified CR bit with the result of a logical operation on a 
specified pair of CR bit fields. 


Conditional branch instructions can test a CR bit as one of the branch conditions. 


If a CR field is set by a compare instruction, the bits are set as described in “CR Fields after Compare 
Instructions.” 


The CR is part of the user programming model. 


CRO CR2 CR4 CR6 


‘ 


0 3|4 7/8 11) 12 15) 16 19) 20 23) 24 27) 28 31 


CR1 CR3 CR5 CR7 


Figure 2-8. Condition Register (CR) 


0:3 CRO Condition Register Field 0 


4:7 CR1 Condition Register Field 1 


8:11 CR2 Condition Register Field 2 


12:15 | CR3 Condition Register Field 3 


16:19 | CR4 Condition Register Field 4 


20:23 | CR5 Condition Register Field 5 


24:27 | CR6 Condition Register Field 6 


28:31 | CR7 Condition Register Field 7 


2.3.3.1. CR Fields after Compare Instructions 


Compare instructions compare the values of two registers. The two types of compare instructions, 
arithmetic and logical, are distinguished by the interpretation given to the 32-bit values. For arithmetic 
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compares, the values are considered to be signed, where 31 bits represent the magnitude and the 
most-significant bit is a sign bit. For logical compares, the values are considered to be unsigned, so 
all 32 bits represent magnitude. There is no sign bit. As an example, consider the comparison of 0 
with OxFFFFFFFF. In an arithmetic compare, 0 is larger, because OxFFFF FFFF represents —1; ina 
logical compare, OxFFFFFFFF is larger. 


A compare instruction can direct its CR update to any CR field. The first data operand of a compare 
instruction specifies a GPR. The second data operand specifies another GPR, or immediate data 
derived from the IM field of the immediate instruction form. The contents of the GPR specified by the 
first data operand are compared with the contents of the GPR specified by the second data operand 
(or with the immediate data). See descriptions of the compare instructions (page 9-34 through 

page 9-37) for precise details. 


After a compare, the specified CR field is interpreted as follows: 


LT (bit 0) The first operand is less than the second operand. 
GT (bit 1) The first operand is greater than the second operand. 
EQ (bit 2) The first operand is equal to the second operand. 

SO (bit 3) Summary overflow; a copy of XER[SO]. 


2.3.3.2 The CRO Field 


After the execution of compare instructions that update CR[CRO], CR[CRO] is interpreted as 
described in “CR Fields after Compare Instructions” on page 2-11. The “dot” forms of arithmetic and 
logical instructions also alter CR[CRO]. After most instructions that update CR[CRO], the bits of CRO 
are interpreted as follows: 


LT (bit 0) Less than 0; set if the most-significant bit of the 32-bit result is 1. 

GT (bit 1) Greater than 0; set if the 32-bit result is non-zero and the most- 
significant bit of the result is 0. 

EQ (bit 2) Equal to 0; set if the 32-bit result is 0. 

SO (bit 3) Summary overflow; a copy of XER[SO] at instruction completion. 


The CR[CRO].7 ct, eq subfields are set as the result of an algebraic comparison of the instruction 
result to 0, regardless of the type of instruction that sets CR[CRO]. If the instruction result is 0, the EQ 
subfield is set to 1. If the result is not 0, either LT or GT is set, depending on the value of the most- 
significant bit of the result. 


When updating CR[CRO], the most significant bit of an instruction result is considered a sign bit, even 
for instructions that produce results that are not usually thought of as signed. For example, logical 
instructions such as and., or., and nor. update CR[CRO]i+, at, eq using such an arithmetic comparison 
to 0, although the result of such a logical operation is not actually an arithmetic result. 


If an arithmetic overflow occurs, the “sign” of an instruction result indicated in CR[CRO].+ gt, eq might 
not represent the “true” (infinitely precise) algebraic result of the instruction that set CRO. For 
example, if an add. instruction adds two large positive numbers and the magnitude of the result 
cannot be represented as a twos-complement number in a 32-bit register, an overflow occurs and 
CR[CRO]_+ so are set, although the infinitely precise result of the add is positive. 
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Adding the largest 32-bit twos-complement negative number, 0x8000 0000, to itself results in an 
arithmetic overflow and 0x0000 0000 is recorded in the target register. CR[CRO]eq so is set, 
indicating a result of 0, but the infinitely precise result is negative. 


The CR[ICRO]so0 subfield is a copy of XER[SO]. Instructions that do not alter the XER[SO] bit cannot 
cause an overflow, but even for these instructions CR[CRO]g, is a copy of XER[SO]. 


Some instructions set CR[CRO] differently or do not specifically set any of the subfields. These 
instructions include: 


* Compare instructions 
cmp, cmpi, cmpl, cmpli 
¢ CR logical instructions 
crand, crandc, creqv, crnand, crnor, cror, crorc, crxor, mcrf 
* Move CR instructions 
mtcrf, merxr 
* stwex. 
The instruction descriptions provide detailed information about how the listed instructions alter 
CR[CRO]. 
2.3.4 The Time Base 


The PowerPC Architecture provides a 64-bit time base. “Time Base” on page 6-1 describes the 
architected time base. Access to the time base is through two 32-bit time base registers (TBRs). The 
least-significant 32 bits of the time base are read from the Time Base Lower (TBL) register and the 
most-significant 32 bits are read from the Time Base Upper (TBU) register. 


User-mode access to the time base is read-only, and there is no explicitly privileged read access to 
the time base. 


The mftb instruction reads from TBL and TBU. Writing the time base is accomplished by moving the 
contents of a GPR to a pair of SPRs, which are also called TBL and TBU, using mtspr. 


Table 2-4 shows the mnemonics and names of the TBRs. 


Table 2-4. Time Base Registers 


Mnemonic Register Name Access 
TBL Time Base Lower (Read-only) Read-only 
TBU Time Base Upper (Read-only) Read-only 


2.3.5 Machine State Register (MSR) 


The Machine State Register (MSR) controls processor core functions, such as the enabling or 
disabling of interrupts and address translation. 


The MSR is written from a GPR using the mtmsr instruction. The contents of the MSR can be read 
into a GPR using the mfmsr instruction. MSR[EE] is set or cleared using the wrtee or wrteei 
instructions. 
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The MSR contents are automatically saved, altered, and restored by the interrupt-handling 
mechanism. See “Machine State Register (MSR)” on page 5-7. 


APE CE PR 


yy 


ME DWE FE1 DR 


+ t 


W 11/12)13/14)15/16)17/18 


19} 20)21 |22)23)24 25)26/27|28 31 


> 
a eae cds 


WE EE FP 


i 


FEO ODE i 


Figure 2-9. Machine State Register (MSR) 


Reserved 


AP 


Auxiliary Processor Available 
0 APU not available. 
1 APU available. 


Reserved 


APE 


APU Exception Enable 
0 APU exception disabled. 
1 APU exception enabled. 


WE 


Wait State Enable 
0 The processor is not in the wait state. 
1 The processor is in the wait state. 


If MSR[WE] = 1, the processor remains in 
the wait state until an interrupt is taken, a 
reset occurs, or an external debug tool 
clears WE. 


CE 


Critical Interrupt Enable 
0 Critical interrupts are disabled. 
1 Critical interrupts are enabled. 


Controls the critical interrupt input and 
watchdog timer first time-out interrupts. 


15 


Reserved 


16 


EE 


External Interrupt Enable 
0 Asynchronous interruptsare disabled. 
1 Asynchronous interrupts are enabled. 


Controls the non-critical external interrupt 
input, PIT, and FIT interrupts. 


PR 


Problem State 

0 Supervisor state (all instructions 
allowed). 

1 Problem state (some instructions not 
allowed). 


FP 


Floating Point Available 
0 The processor cannot execute floating- 
point instructions 


1 The processor can execute floating-point 


instructions 


ME 


Machine Check Enable 
0 Machine check interrupts are disabled. 
1 Machine check interrupts are enabled. 
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20 FEO Floating-point exception mode 0 

O If MSR[FE1] = 0, ignore exceptions 
mode; if MSR[FE1] = 1, imprecise 
nonrecoverable mode 

1 If MSR[FE1] = 0, imprecise recoverable 
mode; if MSR[FE1] = 1, precise mode 


21 DWE _ | Debug Wait Enable 
0 Debug wait mode is disabled. 
1 Debug wait mode is enabled. 


22 DE Debug Interrupts Enable 
0 Debug interrupts are disabled. 
1 Debug interrupts are enabled. 


23 FE1 Floating-point exception mode 1 

0 If MSR[FEO] = 0, ignore exceptions 
mode; if MSR[FEO] = 1, imprecise 
recoverable mode 

1 If MSR[FEO] = 0, imprecise non- 
recoverable mode; if MSR[FEO] = 1, 
precise mode 


24:25 Reserved 


26 IR Instruction Relocate 

0 Instruction address translation is 
disabled. 

1 Instruction address translation is 
enabled. 


27 DR Data Relocate 
0 Data address translation is disabled. 
1 Data address translation is enabled. 


28:31 Reserved 


2.3.6 Device Control Registers 


Device Control Registers (DCRs), on-chip registers that exist architecturally outside the processor 
core, are not part of the IBM PowerPC Embedded Environment. The Embedded Environment simply 
defines the existence of a DCR address space and the instructions that access the DCRs, but does 
not define any DCRs. The instructions that access the DCRs are mtdcr (move to device control 
register) and mfdcr (move from device control register). 


DCRs are used to control the operations of on-chip buses, peripherals, and some processor behavior. 
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2.4 Data Types and Alignment 


The data types consist of bytes (eight bits), halfwords (two bytes), words (four bytes), and strings (1 to 
128 bytes). Figure 2-10 shows the byte, halfword, and word data types and their bit and byte 
definitions for big endian representations of values. Note that PowerPC bit numbering is reversed 
from industry conventions; bit 0 represents the most significant bit of a value. 


Byte 0 1 2 3 Word 
Bit 0 31 
| 0 | 1 Halfword 
0 15 
0 7 


Figure 2-10. PPC405 Data Types 


Data is represented in either twos-complement notation or in an unsigned integer format; data 
representation is independent of alignment issues. 


The address of a data object is always the lowest address of any byte comprising the object. 


All instructions are words, and are word-aligned (the lowest byte address is divisible by 4). 


2.4.1. Alignment for Storage Reference and Cache Control Instructions 


The storage reference instructions (loads and stores; see Table 2-12, “Storage Reference 
Instructions,” on page 2-37) move data to and from storage. The data cache control instructions listed 
in Table 2-21, “Cache Management Instructions,” on page 2-41, control the contents and operation of 
the data cache unit (DCU). Both types of instructions form an effective address (EA). The method of 
calculating the EA for the storage reference and cache control instructions is detailed in the 
description of those instructions. See Chapter 9, “Instruction Set,” for more information. 


Cache control instructions ignore the five least significant bits of the EA; no alignment restrictions 
exist in the DCU because of EAs. However, storage control attributes can cause alignment 
exceptions. When data address translation is disabled and a debz instruction references a storage 
region that is non-cachable, or for which write-through caching is the write strategy, an alignment 
exception is taken. Such exceptions result from the storage control attributes, not from EA alignment. 
The alignment exception enables system software to emulate the write-through function. 


Alignment requirements for the storage reference instructions and the dcread instruction depend on 
the particular instruction. Table 2-5, “Alignment Exception Summary,’ on page 2-17, summarizes the 
instructions that cause alignment exceptions. 


The data targets of instructions are of types that depend upon the instruction. The load/store 
instructions have the following “natural” alignments: 


¢ Load/store word instructions have word targets, word-aligned. 
¢ Load/ store halfword instructions have halfword targets, halfword-aligned. 
¢ Load/store byte instructions have byte targets, byte-aligned (that is, any alignment). 
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Misalignments are addresses that are not naturally aligned on data type boundaries. An address not 
divisible by four is misaligned with respect to word instructions. An address not divisible by two is 
misaligned with respect to halfword instructions. The PPC405 core implementation handles 
misalignments within and across word boundaries, but there is a performance penalty because 
additional cycles are required. 


2.4.2 Alignment and Endian Operation 


The endian storage control attribute does not affect alignment behavior. In little endian storage 
regions, the alignment of data is treated as it is in big endian storage regions; no special alignment 
exceptions occur when accessing data in little endian storage regions. Note that the alignment 
exceptions that apply to big endian region accesses also apply to little endian storage region 
accesses. 


2.4.3 Summary of Instructions Causing Alignment Exceptions 


Table 2-5 summarizes the instructions that cause alignment exceptions and the conditions under 
which the alignment exceptions occur. 


Table 2-5. Alignment Exception Summary 


Instructions Causing Alignment 
Exceptions Conditions 
dcbz EA in non-cachable or write-through storage 
dcread, lwarx, stwex. EA not word-aligned 
APU load/store halfword EA not halfword-aligned 
APU load/store word EA not word-aligned 
APU load/store doubleword EA not word-aligned 


2.5 Byte Ordering 


The following discussion describes the “endianness” of the PPC405, which, by default and in normal 
use is “big endian.” 


If scalars (individual data items and instructions) were indivisible, “byte ordering” would not be a 
concern. It is meaningless to consider the order of bits or groups of bits within a byte, the smallest 
addressable unit of storage; nothing can be observed about such order. Only when scalars, which the 
programmer and processor regard as indivisible quantities, can comprise more than one addressable 
unit of storage does the question of byte order arise. 


For a machine in which the smallest addressable unit of storage is the 32-bit word, there is no 
question of the ordering of bytes within words. All transfers of individual scalars between registers and 
storage are of words, and the address of the byte containing the high-order eight bits of a scalar is the 
same as the address of any other byte of the scalar. 


For the PowerPC Architecture, as for most computer architectures currently implemented, the 
smallest addressable unit of storage is the 8-bit byte. Other scalars are halfwords, words, or 
doublewords, which consist of groups of bytes. When a word-length scalar is moved from a register to 
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storage, the scalar is stored in four consecutive byte addresses. It thus becomes meaningful to 
discuss the order of the byte addresses with respect to the value of the scalar: that is, which byte 
contains the highest-order eight bits of the scalar, which byte contains the next-highest-order eight 
bits, and so on. 


Given a scalar that contains multiple bytes, the choice of byte ordering is essentially arbitrary. There 
are 4! = 24 ways to specify the ordering of four bytes within a word, but only two of these orderings 
are commonly used: 


¢ The ordering that assigns the lowest address to the highest-order (“leftmost”) eight bits of the 
scalar, the next sequential address to the next-highest-order eight bits, and so on. 


This ordering is called big endian because the “big end” of the scalar, considered as a binary 
number, comes first in storage. 


¢ The ordering that assigns the lowest address to the lowest-order (“rightmost”) eight bits of the 
scalar, the next sequential address to the next-lowest-order eight bits, and so on. 


This ordering is called /ittle endian because the “little end” of the scalar, considered as a binary 
number, comes first in storage. 


2.5.1 Structure Mapping Examples 


The following C language structure, s, contains an assortment of scalars and a character string. The 
comments show the value assumed to be in each structure element; these values show how the 
bytes comprising each structure element are mapped into storage. 


struct { 
int a; /* 0x1112_1314 word */ 
longlongb; = /* 0x2122_ 2324 2526 2728 doubleword */ 
char *c; /* 0x3132_3334 word */ 
char d[7]; /*'A’,'B','C','D',E','F','G' array of bytes */ 
short e; /* 0x5152 halfword */ 
int f; /* 0x6162_6364 word */ 

} s; 


C structure mapping rules permit the use of padding (skipped bytes) to align scalars on desirable 
boundaries. The structure mapping examples show each scalar aligned at its natural boundary. This 
alignment introduces padding of four bytes between a and b, one byte between d and e, and two 
bytes between e and f The same amount of padding is present in both big endian and little endian 
mappings. 
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2.5.1.1. Big Endian Mapping 


The big endian mapping of structure s follows. (The data is highlighted in the structure mappings. 
Addresses, in hexadecimal, are below the data stored at the address. The contents of each byte, as 
defined in structure s, is shown as a (hexadecimal) number or character (for the string elements). 


11 12 13 14 
0x00 | 0x01 | 0x02 | 0x03 | 0x04 | 0x05 | 0x06 | 0x07 
21 22 23 24 25 26 27 28 
0x08 | 0x09 | OxO0A | OxOB | Ox0C | OxOD | OxOE | Ox0F 
31 32 33 34 ‘A' "B' ‘C' ‘D' 
Ox10 | Ox11 | 0x12 | 0x13 | 0x14 | 0x15 | 0x16 | 0x17 
'E 'F 'G' 51 52 
0x18 | 0x19 | Ox1A | Ox1B | Ox1C | 0x1D | Ox1E | Ox1F 
61 | 62 | 63 | 64 
0x20 | 0x21 | 0x22 | 0x23 | 0x24 | 0x25 | 0x26 | 0x27 


2.5.1.2 Little Endian Mapping 


Structure s is shown mapped little endian. 


14 13 12 11 
0x00 | 0x01 | 0x02 | 0x03 | 0x04 | 0x05 | 0x06 | 0x07 
28 27 26 25 24 23 22 21 
0x08 | 0x09 | OxOA | OxOB | Ox0C | OxOD | OxO0E | Ox0F 
34 33 32 31 ‘A' 'B' ‘C' ‘D' 
0x10 | Ox11 | 0x12 | 0x13 | 0x14 | 0x15 | 0x16 | 0x17 
= 'F 'G' 52 51 
0x18 | 0x19 | Ox1A | 0x1B | Ox1C | 0x1D | Ox1E | Ox1F 
64 63 62 61 
0x20 | 0x21 | 0x22 | 0x23 | 0x24 | 0x25 | 0x26 | 0x27 


2.5.2 Support for Little Endian Byte Ordering 


This book describes the processor as if it operated only in a big endian fashion. In fact, the IBM 
PowerPC Embedded Environment also supports little endian operation. 


The PowerPC little endian mode, defined in the PowerPC Architecture, is not implemented. 


2.5.3 Endian (E) Storage Attribute 


The endian (E) storage attribute supports direct connection of the PPC405 core to little endian 
peripherals and to memory containing little endian instructions and data. For every storage reference 
(instruction fetch or load/store access), an E storage attribute is associated with the storage region of 
the reference. The E attribute specifies whether that region is organized as big endian (E = 0) or little 
endian (E = 1). 
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When address translation is enabled (MSR[IR] = 1 or MSR[DR] = 1), the E field in the corresponding 
TLB entry controls the endianness of a memory region. When address translation is disabled 
(MSR[IR] = 0 or MSR[DR] = 0), the SLER controls the endianness of a memory region. 


Bytes in storage that are accessed as little endian are arranged in true little endian format. The 
PPC405 does not support the little endian mode defined in the PowerPC architecture and used in 
PPC401xx and PPC4038xx processors. Furthermore, no address modification is performed when 
accessing storage regions programmed as little endian. Instead, the PPC405 reorders the bytes as 
they are transferred between the processor and memory. 


The on-the-fly reversal of bytes in little endian storage regions is handled in one of two ways, 
depending on whether the storage access is an instruction fetch or a data access (load/store). The 
following sections describe byte reordering for the two kinds of storage accesses. 


2.5.3.1 Fetching Instructions from Little Endian Storage Regions 


Instructions are words (four bytes) that are aligned on word boundaries in memory. As such, 
instructions in a big endian memory region are arranged with the most significant byte (MSB) of the 
instruction word at the lowest address. 


Consider the big endian mapping of instruction p at address 00, where, for example, 
p=add 7, r7, r4: 


MSB LSB 
Ox00 | Ox01 | 0x02 | 0x03 


On the other hand, in the little endian mapping instruction p is arranged with the least significant byte 
(LSB) of the instruction word at the lowest numbered address: 


LSB MSB 
0x00 | 0x01 | 0x02 | 0x03 


When an instruction is fetched from memory, the instruction must be placed in the instruction queue in 
the proper order. The execution unit assumes that the MSB of an instruction word is at the lowest 
address. Therefore, when instructions are fetched from little endian storage regions, the four bytes of 
an instruction word are reversed before the instruction is decoded. In the PPC405 core, the byte 
reversal occurs between memory and the instruction cache unit (ICU). The ICU always stores 
instructions in big endian format, regardless of whether the memory region containing the instruction 
is programmed as big endian or little endian. Thus, the bytes are already in the proper order when an 
instruction is transferred from the ICU to the decode stage of the pipeline. 


If a storage region is reprogrammed from one endian format to the other, the storage region must be 
reloaded with program and data structures in the appropriate endian format. If the endian format of 
instruction memory changes, the ICU must be made coherent with the updates. The ICU must be 
invalidated and the updated instruction memory using the new endian format must be fetched so that 
the proper byte ordering occurs before the new instructions are placed in the ICU. 
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2.5.3.2 Accessing Data in Little Endian Storage Regions 


Unlike instruction fetches from little endian storage regions, data accesses from little endian storage 
regions are not byte-reversed between memory and the DCU. Data byte ordering, in memory, 
depends on the data type (byte, halfword, or word) of a specific data item. It is only when moving a 
data item of a specific type from or to a GPR that it becomes known what type of byte reversal is 
required. Therefore, byte reversal during load/store accesses is performed between the DCU and the 
GPR. 


When accessing data in a little endian storage region: 

¢ For byte loads/stores, no reordering occurs. 

¢ For halfword loads/stores, bytes are reversed within the halfword. 
¢ For word loads/stores, bytes are reversed within the word. 

Note that this applies, regardless of data alignment. 


The big endian and little endian mappings of the structure s, shown in “Structure Mapping Examples” 
on page 2-18, demonstrate how the size of an item determines its byte ordering. For example: 


¢ The word ahas its four bytes reversed within the word spanning addresses 0x00-0x03. 
* The halfword e has its two bytes reversed within the halfword spanning addresses 0x1C—Ox1D. 


Note that the array of bytes d, where each data item is a byte, is not reversed when the big endian and 
little endian mappings are compared. For example, the character 'A' is located at address 0x14 in 
both the big endian and little endian mappings. 


In little endian storage regions, the alignment of data is treated as it is in big endian storage regions. 
Unlike PowerPC little endian mode, no special alignment exceptions occur when accessing data in 
little endian storage regions. 


2.5.3.3 PowerPC Byte-Reverse Instructions 


For big endian storage regions, normal load/store instructions move the more significant bytes of a 
register to and from the lower-numbered memory addresses. The load/store with byte-reverse 
instructions move the more significant bytes of the register to and from the higher numbered memory 
addresses. 


As Figure 2-11 through Figure 2-14 illustrate, a normal store to a big endian storage region is the 
same as a byte-reverse store to a little endian storage region. Conversely, a normal store to a little 
endian storage region is the same as a byte-reverse store to a big endian storage region. 
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Figure 2-11 illustrates the contents of a GPR and memory (starting at address 00) after a normal 
load/store in a big endian storage region. 


MSB LSB 

11 12 13 14 GPR 

11 12 13 14 Memory 
0x00 0x01 0x02 0x03 


Figure 2-11. Normal Word Load or Store (Big Endian Storage Region) 


Note that the results are identical to the results of a load/store with byte-reverse in a little endian 
storage region, as illustrated in Figure 2-12. 


MSB LSB 


a es ee 


11 12 13 14 Memory 


0x00 0x01 0x02 0x03 


Figure 2-12. Byte-Reverse Word Load or Store (Little Endian Storage Region) 


Figure 2-13 illustrates the contents of a GPR and memory (starting at address 00) after a load/store 
with byte-reverse in a big endian storage region. 


MSB LSB 

11 12 13 14 GPR 

14 13 12 11 Memory 
0x00 0x01 0x02 0x03 


Figure 2-13. Byte-Reverse Word Load or Store (Big Endian Storage Region) 
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Note that the results are identical to the results of a normal load/store in a little endian storage region, 
as illustrated in Figure 2-14. 


MSB LSB 

11 12 13 14 GPR 

14 13 12 11 Memory 
0x00 0x01 0x02 0x03 


Figure 2-14. Normal Word Load or Store (Little Endian Storage Region) 


The E storage attribute augments the byte-reverse load/store instructions in two important ways: 


¢ The load/store with byte-reverse instructions do not solve the problem of fetching instructions from 
a storage region in little endian format. 


Only the endian storage attribute mechanism supports the fetching of little endian program images. 


* Typical compilers cannot make general use of the byte-reverse load/store instructions, so these 
instructions are ordinarily used only in device drivers written in hand-coded assembler. 


Compilers can, however, take full advantage of the endian storage attribute mechanism, enabling 
application programmers working in a high-level language, such as C, to compile programs and 
data structures into little endian format. 


2.6 Instruction Processing 


The instruction pipeline, illustrated in Figure 2-15, contains three queue locations: prefetch buffer 1 
(PFB1), prefetch buffer 0 (PFBO), and decode (DCD). This queue implements a pipeline with the 
following functional stages: fetch, decode, execute, write-back and load write-back. Instructions are 
fetched from the instruction cache unit (ICU), placed in the instruction queue, and eventually 
dispatched to the execution unit (EXU). 


Instructions are fetched from the ICU at the request of the EXU. Cachable instructions are forwarded 
directly to the instruction queue and stored in the ICU cache array. Non-cachable instructions are also 
forwarded directly to the instruction queue, but are not stored in the ICU cache array. Fetched 
instructions drop to the empty queue location closest to the EXU. When there is room in the queue, 
instructions can be returned from the ICU two at a time. If the queue is empty and the ICU is returning 
two instructions, one instruction drops into DCD while the other drops into PFBO. PFB1 buffers 
instructions when the pipeline stalls. 


Programming Model 2-23 


Branch instructions are examined in DCD and PFBO while all other instructions are decoded in DCD. 
All instructions must pass through DCD before entering the EXU. The EXU contains the execute, 
write-back and load write-back stages of the pipe. The results of most instructions are calculated 
during the execute stage and written to the GPR file during the write back stage. Load instructions 
write the GPR file during the load write-back stage. 


Fetch 


Instruction 
Queue 


Dispatch 


EXU 


Figure 2-15. PPC405 Instruction Pipeline 


2.7. Branch Processing 


The PPC405, which provides a variety of conditional and unconditional branching instructions, uses 
the branch prediction techniques described in “Branch Prediction” on page 3-35. 


2.7.1. Unconditional Branch Target Addressing Options 


The unconditional branches (b, ba, bl, bla) carry the displacement to the branch target address as a 
signed 26-bit value (the 24-bit LI field right-extended with 0b00). The displacement enables 
unconditional branches to cover an address range of +32MB. 


For the relative (AA = 0) forms (b, bl), the target address is the current instruction address (CIA, the 
address of the branch instruction) plus the signed displacement. 


For the absolute (AA = 1) forms (ba, bla), the target address is 0 plus the signed displacement. If the 
sign bit (LI[0]) is 0, the displacement is the target address. If the sign bit is 1, the displacement is a 
negative value and wraps to the highest memory addresses. For example, if the displacement is 
Ox3FF FFFC (the 26-bit representation of —4), the target address is OxFFFF FFFC (0 — 4B, or 4 bytes 
below the top of memory). 


2.7.2 Conditional Branch Target Addressing Options 


The conditional branches (be, bea, bel, bcla) carry the displacement to the branch target address as 
a signed 16-bit value (the 14-bit BD field right-extended with 0b00). The displacement enables 
conditional branches to cover an address range of +32KB. 
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For the relative (AA = 0) forms (be, bel), the target address is the CIA plus the signed displacement. 


For the absolute (AA = 1) forms (bea, bela), the target address is 0 plus the signed displacement. If 
the sign bit (BD[0]) is 0, the displacement is the target address. If the sign bit is 1, the displacement is 
negative and wraps to the highest memory addresses. For example, if the displacement is OxFFFC 
(the 16-bit representation of —4), the target address is OxFFFF FFFC (0 — 4B, or 4 bytes from the top 
of memory). 


2.7.3 Conditional Branch Condition Register Testing 


Conditional branch instructions can test a CR bit. The value of the BI field specifies the bit to be tested 
(bit 0-31). The BO field controls whether the CR bit is tested, as described in the following section. 


2.7.4 BO Field on Conditional Branches 


The BO field of the conditional branch instruction specifies the conditions used to control branching, 
and specifies how the branch affects the CTR. 


Conditional branch instructions can test one bit in the CR. This option is selected when BO[O] = 0; if 
BO[0] = 1, the CR does not participate in the branch condition test. If this option is selected, the 
condition is satisfied (branch can occur) if CR[BI] = BO[1]. 


Conditional branch instructions can decrement the CTR by one, and after the decrement, test the 
CTR value. This option is selected when BO[2] = 0. If this option is selected, BO[3] specifies the 
condition that must be satisfied to allow a branch to be taken. If BO[3] = 0, CTR # 0 is required for a 
branch to occur. If BO[3] = 1, CTR = 0 is required for a branch to occur. 


If BO[2] = 1, the contents of the CTR are left unchanged, and the CTR does not participate in the 
branch condition test. 


Table 2-6 summarizes the usage of the bits of the BO field. BO[4] is further discussed in “Branch 
Prediction.” 


Table 2-6. Bits of the BO Field 
BO Bit Description 


BO[0] CR Test Control 

0 Test CR bit specified by BI field for value specified by BO[1] 
1 Do not test CR 

BO[1] CR Test Value 

0 Test for CR[BI] = 0. 

1 Test for CR[BI] = 1. 


BO[2] CTR Test Control 

0 Decrement CTR by one and test whether CTR satisfies the 
condition specified by BO[8]. 

1 Do not change CTR, do not test CTR. 

BO[3] CTR Test Value 

0 Test for CTR #0. 

1 Test for CTR = 0. 

BO[4] Branch Prediction Reversal 

0 Apply standard branch prediction. 

1 Reverse the standard branch prediction. 
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Table 2-7 lists specific BO field contents, and the resulting actions; z represents a mandatory value of 
0, and yis a branch prediction option discussed in “Branch Prediction.” 


Table 2-7. Conditional Branch BO Field 


BO 
Value Description 


0000y Decrement the CTR, then branch if the decremented CTR z 0 and CRI[BI]=0. 
0001 y Decrement the CTR, then branch if the decremented CTR = 0 and CR[BI] = 0. 
001 zy Branch if CR[BI] = 0. 
0100y Decrement the CTR, then branch if the decremented CTR #0 and CRIBI] = 1. 
0101y Decrement the CTR, then branch if the decremented CTR=0 and CR[BI] = 1. 
O11zy Branch if CR[BI] = 1. 
1z00y Decrement the CTR, then branch if the decremented CTR z 0. 
1z01y Decrement the CTR, then branch if the decremented CTR = 0. 


1z12zz Branch always. 


2.7.5 Branch Prediction 


Conditional branches present a problem to the instruction fetcher. A branch might be taken. The 
branch EXU attempts to predict whether or not a branch is taken before all information necessary to 
determine the branch direction is available. This decision is called a branch prediction. The fetcher 
can then prefetch instructions starting at the predicted branch target address. If the prediction is 
correct, time is saved because the branched-to instruction is available in the instruction queue. 
Otherwise, the instruction pipeline stalls while the correct instruction is fetched into the instruction 
queue. To be effective, branch prediction must be correct most of the time. 


The PowerPC Architecture enables software to reverse the default branch prediction, which is defined 
as follows: 


Predict that the branch is to be taken if ((BO[O] ~ BO[2]) v s) = 1 


where sis the sign bit of the displacement for conditional branch (bc) instructions, and 0 for belr and 
bectr instructions. 


(BO[0] 4 BO[2]) = 1 only when the conditional branch tests nothing (the “branch always” condition). 
Obviously, the branch should be predicted taken for this case. 


If the branch tests anything, (BO[0] ~ BO[2]) = 0, and s entirely controls the prediction. The default 
prediction for this case was decided by considering the relative form of bce, which is commonly used at 
the end of loops to control the number of times that a loop is executed. The branch is taken every time 
the loop is executed except the last, so it is best if the branch is predicted taken. The branch target is 
the beginning of the loop, so the branch displacement is negative and s = 1. 


If branch displacements are positive (s = 0), the branch is predicted not taken. If the branch 
instruction is any form of belr or bectr except the “branch always” forms, then s = 0, and the branch is 
predicted not taken. 


There is a peculiar consequence of this prediction algorithm for the absolute forms of be (bea and 
bcla). As described in “Unconditional Branch Target Addressing Options” on page 2-24, if the 
algebraic sign of the displacement is negative (s = 1), the branch target address is in high memory. If 
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the algebraic sign of the displacement is positive (s = 0), the branch target address is in low memory. 
Because these are absolute-addressing forms, there is no reason to treat high and low memory 
differently. Nevertheless, for the high memory case the default prediction is taken, and for the low 
memory case the default prediction is not taken. 


BO[4] is the prediction reversal bit. \f BO[4] = 0, the default prediction is applied. If BO[4] = 1, the 
reverse of the standard prediction is applied. For the cases in Table 3-17 where BO[4] = y, software 
can reverse the default prediction. This should only be done when the default prediction is likely to be 
wrong. Note that for the “oranch always” condition, reversal of the default prediction is not allowed. 


The PowerPC Architecture requires assemblers to provide a way to conveniently control branch 
prediction. For any conditional branch mnemonic, a suffix may be added to the mnemonic to control 
prediction, as follows: 


+ Predict branch to be taken 
— Predict branch to be not taken 


For example, bectr+ causes BO[4] to be set appropriately to force the branch to be predicted taken. 


2.8 Speculative Accesses 


The PowerPC Architecture permits implementations to perform speculative accesses to memory, 
either for instruction fetching, or for data loads. A speculative access is defined as any access which 
is not required by a sequential execution model. 


For example, prefetching instructions beyond an undetermined conditional branch is a speculative 
fetch; if the branch is not in the predicted direction, the program, as executed, never needs the 
instructions from the predicted path. 


Sometimes speculative accesses are inappropriate. For example, attempting to fetch instructions 
from addresses that cannot contain instructions can cause problems.To protect against errant 
accesses to “sensitive” memory or I/O devices, the PowerPC Architecture provides the G (guarded) 
storage attribute, which can be used to specify memory pages from which speculative accesses are 
prohibited. (Actually, speculative accesses to guarded storage are allowed in certain limited 
circumstances; if an instruction in a cache block will be executed, the rest of the cache block can be 
speculatively accessed.) 


2.8.1. Speculative Accesses in the PPC405 
The PPC405 does not perform speculative loads. 


Two methods control speculative instruction fetching. If instruction address translation is enabled 
(MSR[IR] = 1), the G (guarded) field in the translation lookaside buffer (TLB) entries controls 
speculative accesses. 


If instruction address translation is disabled (MSR[IR] = 0), the Storage Guarded Register (SGR) 
controls speculative accesses for regions of memory. When a region is guarded (speculative fetching 
is disallowed), instruction prefetching is disabled for that region. A fetch request must be completely 
resolved (no longer speculative) before it is issued. There is a considerable performance penalty for 
fetching from guarded storage, so guarding should be used only when required. 


Note that, following any reset, the PPC405 core operates with all of storage guarded. 
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Note that when address translation is enabled, attempts to fetch from guarded storage result in 
instruction storage exceptions. Guarded memory is in most often needed with peripheral status 
registers that are cleared automatically after being read, because an unintended access resulting 
from a speculative fetch would cause the loss of status information. Because the MMU provides 64 
pages with a wide range of page sizes as small as 1KB, fetching instructions from guarded storage 
should be unnecessary. 


2.8.1.1. Prefetch Distance Down an Unresolved Branch Path 


The fetcher will speculatively access up to 19 instructions down a predicted branch path, whether 
taken or sequential, regardless of cachability. 


2.8.1.2 Prefetch of Branches to the CTR and Branches to the LR 


When the instruction fetcher predicts that a betr or blr instruction will be taken, the fetcher does not 
attempt to fetch an instruction from the target address in the CTR or LR if an executing instruction 
updates the register ahead of the branch. (See “Instruction Processing” on page 2-23 fora 
description of the instruction pipeline). The fetcher recognizes that the CTR or LR contains data left 
from an earlier use and that such data is probably not valid. 


In such cases, the fetcher does not fetch the instruction at the target address until the instruction that 
is updating the CTR or LR completes. Only then are the “correct” CTR or LR contents known. This 
prevents the fetcher from speculatively accessing a completely “random” address. After the CTR or 
LR contents are known to be correct, the fetcher accesses no more than five instructions down the 
sequential or taken path of an unresolved branch, or at the address contained in the CTR or LR. 


2.8.2 Preventing Inappropriate Speculative Accesses 


A memory-mapped I/O peripheral, such as a serial port having a status register that is automatically 
reset when read provides a simple example of storage that should not be speculatively accessed. If 
code is in memory at an address adjacent to the peripheral (for example, code goes from 

0x0000 0000 to 0x0000 OFFF, and the peripheral is at Ox0000 1000), prefetching past the end of the 
code will read the peripheral. 


Guarding storage also prevents prefetching past the end of memory. If the highest memory address is 
left unguarded, the fetcher could attempt to fetch past the last valid address, potentially causing 
machine checks on the fetches from invalid addresses. While the machine checks do not actually 
cause an exception until the processor attempts to execute an instruction at an invalid address, some 
systems could suffer from the attempt to access such an invalid address. For example, an external 
memory controller might log an error. 


System designers can avoid problems from speculative fetching without using the guarded storage 
attributes. The rest of this section describes ways to prevent speculative instruction fetches to 
sensitive addresses in unguarded memory regions. 


2.8.2.1 Fetching Past an Interrupt-Causing or Interrupt-Returning Instruction 


Suppose a betr or blir instruction closely follows an interrupt-causing or interrupt-returning instruction 
(sc, rfi, or rfci). The fetcher does not prevent speculatively fetching past one of these instructions. In 
other words, the fetcher does not treat the interrupt-causing and interrupt-returning instructions 
specially when deciding whether to predict down a branch path. Instructions after an rfi, for example, 
are considered to be on the determined branch path. 


2-28 PPC405 Core User’s Manual 


To understand the implications of this situation, consider the code sequence: 


handler: aaa 
bbb 
rfi 

subroutine: bctr 


When executing the interrupt handler, the fetcher does not recognize the rfi as a break in the program 
flow, and speculatively fetches the target of the betr, which is really the first instruction of a subroutine 
that has not been called. Therefore, the CTR might contain an invalid pointer. 


To protect against such a prefetch, the software must insert an unconditional branch hang (b $) just 
after the rfi. This prevents the hardware from prefetching the invalid target address used by betr. 


Consider also the above code sequence, with the rfi instruction replaced by an sc instruction used to 
initialize the CTR with the appropriate value for the bctr to branch to, upon return from the system 
call. The sc handler returns to the instruction following the sc, which can’t be a branch hang. Instead, 
software could put a mtctr just before the sc to load a non-sensitive address into the CTR. This 
address will be used as the prediction address before the sc executes. An alternative would be to put 
a mfctr or mtctr between the sc and the bctr; the mtctr prevents the fetcher from speculatively 
accessing the address contained in the CTR before initialization. 


2.8.2.2 Fetching Past tw or twi Instructions 


The interrupt-causing instructions, tw and twi, do not require the special handling described in 
“Fetching Past an Interrupt-Causing or Interrupt-Returning Instruction” on page 2-28. These 
instructions are typically used by debuggers, which implement software breakpoints by substituting a 
trap instruction for the instruction originally at the breakpoint address. In a code sequence mtir 
followed by blr (or mtctr followed by bctr), replacement of mtlr/mtctr by tw or twi leaves the LR/CTR 
uninitialized. It would be inappropriate to fetch from the blr/bctr target address. This situation is 
common, and the fetcher is designed to prevent the problem. 


2.8.2.3 Fetching Past an Unconditional Branch 


When an unconditional branch is in DCD in the instruction queue, the fetcher recognizes that the 
sequential instructions following the branch are unnecessary. These sequential addresses are not 
accessed. Addresses at the branch target are accessed instead. 


Therefore, placing an unconditional branch just before the start of a sensitive address space (for 
example, at the “end” of a memory area that borders an I/O device) guarantees that addresses in the 
sensitive area will not be speculatively fetched. 


2.8.2.4 Suggested Locations of Memory-Mapped Hardware 


The preferred method of protecting memory-mapped hardware from inadvertent access is to use 
address translation, with hardware isolated to guarded pages (the G storage attribute in the 
associated TLB entry is set to 1.) The pages can be as small as 1KB. Code should never be stored in 
such pages. 


If address translation is disabled, the preferred protection method is to isolate memory-mapped 
hardware into regions guarded using the SGR. Code should never be stored in such regions. The 
disadvantage of this method, compared to the preferred method, is that each region guarded by the 
SGR consumes 128MB of the address space. 
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Table 2-8 shows two address regions of the PPC405 core. Suppose a system designer can map all 
I/O devices and all ROM and SRAM devices into any location in either region. The choices made by 
the designer can prevent speculative accesses to the memory-mapped I/O devices. 


Table 2-8. Example Memory Mapping 
0x7800 0000 — Ox7FFF FFFF (SGR bit 15) | 128MB Region 2 
0x7000 0000 — 0x77FF FFFF (SGR bit 14) | 128MB Region 1 


A simple way to avoid the problem of speculative reads to peripherals is to map all storage containing 
code into Region 2, and all I/O devices into Region 1. Thus, accesses to Region 2 would only be for 
code and program data. Speculative fetches occuring in Region 2 would never access addresses in 
Region 1. Note that this hardware organization eliminates the need to use of the G storage attribute to 
protect Region 1. However, Region 1 could be set as guarded with no performance penalty, because 
there is no code to execute or variable data to access in Region 1. 


The use of these regions could be reversed (code in Region 1 and I/O devices in Region 2), if Region 
2 is set as guarded. Prefetching from the highest addresses of Region 1 could cause an attempt to 
speculatively access the bottom of Region 2, but guarding prevents this from occurring. The 
performance penalty is slight, under the assumption that code infrequently executes the instructions 
in the highest addresses of Region 1. 


2.8.3 Summary 


Software should take the following actions to prevent speculative accesses to sensitive data areas, if 
the sensitive data areas are not in guarded storage: 


¢ Protect against accesses to “random” values in the LR or CTR on bir or betr branches following rfi, 
rfci, or sc instructions by putting appropriate instructions before or after the rfi, rfci, or sc 
instruction. See “Fetching Past an Interrupt-Causing or Interrupt-Returning Instruction” on 
page 2-28. 


¢ Protect against “running past” the end of memory into a bordering I/O device by putting an 
unconditional branch at the end of the memory area. See “Fetching Past an Unconditional Branch” 
on page 2-29. 


¢ Recognize that a maximum of 19 words can be prefetched past an unresolved conditional branch, 
either down the target path or the sequential path. See “Prefetch Distance Down an Unresolved 
Branch Path” on page 2-28. 


Of course, software should not code branches with known unsafe targets (either relative to the 
instruction counter, or to addresses contained in the LR or CTR), on the assumption that the targets 
are “protected” by code guaranteeing that the unsafe direction is not taken. The fetcher assumes that 
if a branch is predicted to be taken, it is safe to fetch down the target path. 


2.9 Privileged Mode Operation 
In the PowerPC Architecture, several terms describe two operating modes that have different 


instruction execution privileges. When a processor is in “privileged mode,” it can execute all 
instructions in the instruction set. This mode is also called the “supervisor state.” The other mode, in 
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which certain instructions cannot be executed, is called the “user mode,” or “problem state.” These 
terms are used in pairs: 


Privileged Non-privileged 
Privileged Mode | User Mode 
Supervisor State | Problem State 


The architecture uses MSR[PR] to control the execution mode. When MSR[PR] = 1, the processor is 
in user mode (problem state); when MSR[PR] = 0, the processor is in privileged mode (supervisor 
state). 


After a reset, MSR[PR] = 0. 


2.9.1 MSR Bits and Exception Handling 


The current value of MSR[PR] is saved, along with all other MSR bits, in the SRR1 (for non-critical 
interrupts) or SRR@ (for critical interrupts) upon any interrupt, and MSR[PR] is set to 0. Therefore, all 
exception handlers operate in privileged mode. 


Attempting to execute a privileged instruction while in user mode causes a privileged violation 
program exception (see “Program Interrupt” on page 5-20). The PPC405 core does not execute the 
instruction, and the program counter is loaded with EVPR[0:15] || 0x0700, the address of an 
exception processing routine. 


The PRR field of the Exception Syndrome Register (ESR) is set when an interrupt was caused by a 
privileged instruction program exception. Software is not required to clear ESR[PPR]. 
2.9.2 Privileged Instructions 


The instructions listed in Table 2-9 are privileged and cannot be executed while in user mode 
(MSR[PR] = 1). 


Table 2-9. Privileged Instructions 


dcbi 
dccci 


dcread 


iccci 


icread 


mfdcr 


mfmsr 


mfspr For all SPRs except CTR, LR, SPRG4—-SPRG7, and XER. See 
“Privileged SPRs’” on page 2-32 


mtdcr 


mtmsr 
mtspr For all SPRs except CTR, LR, XER. See “Privileged SPRs” on page 2-32 
rfci 


rfi 
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Table 2-9. Privileged Instructions (continued) 


tlbia 
tlbre 
tlbsx 
tlbsync 
tlbwe 


wrtee 


wrteei 


2.9.3 Privileged SPRs 


All SPRs are privileged, except for the LR, the CTR, the XER, USPRGO, and read access to SPRG4— 
SPRG7. Reading from the time base registers Time Base Lower (TBL) and Time Base Upper (TBU) 
is not privileged. These registers are read using the mftb instruction, rather than the mfspr 
instruction. TBL and TBU are written (with different addresses) using mtspr, which is privileged for 
these registers. Except for moves to and from non-privileged SPRs, attempts to execute mfspr and 
mtspr instructions while in user mode result in privileged violation program exceptions. 


In a mfspr or mtspr instruction, the 10-bit SPRN field specifies the SPR number of the source or 
destination SPR. The SPRN field contains two five-bit subfields, SPRNo-4 and SPRNs.9. The 
assembler handles the unusual register number encoding to generate the SPRF field. In the machine 
code for the mfspr and mtspr instructions, the SPRN subfields are reversed (ending up as SPRF 5.9 
and SPRF .4) for compatibility with the POWER Architecture. 


In the PowerPC Architecture, SPR numbers having a 1 in the most-significant bit of the SPRF field are 
privileged. 


The following example illustrates how SPR numbers appear in assembler language coding and in 
machine coding of the mfspr and mtspr instructions. 


In assembler language coding, SRRO is SPR 26. Note that the assembler handles the unusual 
register number encoding to generate the SPRFF field. 


mfspr r5,26 


When the SPR number is considered as a binary number (000000011010), the most-significant bit is 
0. However, the machine code for the instruction reverses the subfields, resulting in the following 
SPRF field: 061101000000. The most-significant bit is 1; SRRO is privileged. 


When an SPR number is considered as a hexadecimal number, the second digit of the three-digit 
hexadecimal number indicates whether an SPR is privileged. If the second digit is odd (1, 3, 5, 7, 9, B, 
D, F), the SPR is privileged. 


For example, the SPR number of SRRO is 26 (0x01A). The second hexadecimal digit is odd; SRRO is 
privileged. In contrast, the LR is SPR 8 (0x008); the second hexadecimal digit is not odd; the LR is 
non-privileged. 


2.9.4 Privileged DCRs 


The mtder and mfdcr instructions themselves are privileged, in all cases. All DCRs are privileged. 
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2.10 Synchronization 


The PPC405 core supports the synchronization operations of the PowerPC Architecture. The 
following book, chapter, and section numbers refer to related information in The PowerPC 
Architecture: A Specification for a New Family of RISC Processors: 


* Book II, Section 1.8.1, “Storage Access Ordering” and “Enforce In-order Execution of I/O” 
* Book III, Section 1.7, “Synchronization” 
¢ Book Ill, Chapter 7, “Synchronization Requirements for Special Registers and Lookaside Buffers” 


2.10.1 Context Synchronization 


The context of a program is the environment (for example, privilege and address translation) in which 
the program executes. Context is controlled by the content of certain registers, such as the Machine 
State Register (MSR), and includes the content of all GPRs and SPRs. 


An instruction or event is context synchronizing if it satisfies the following requirements: 


1. All instructions that precede a context synchronizing operation must complete in the context that 
existed before the context synchronizing operation. 


2. All instructions that follow a context synchronizing operation must complete in the context that 
exists after the context synchronizing operation. 


Such instructions and events are called “context synchronizing operations.” In the PPC405 core, 
these include any interrupt, except a non-recoverable instruction machine check, and the isync, rfci, 
rfi, and sc instructions. 


However, context specifically excludes the contents of memory. A context synchronizing operation 
does not guarantee that subsequent instructions observe the memory context established by 
previous instructions. To guarantee memory access ordering in the PPC405 core, one must use 
either an eieio instruction or a sync instruction. Note that for the PPC405 core, the eieio and sync 
instructions are implemented identically. See “Storage Synchronization” on page 2-35. 


The contents of DCRs are not considered as part of the processor “context” managed by a context 
synchronizing operation. DCRs are not part of the processor core, and are analogous to memory- 
mapped registers. Their context is managed in a manner similar to that of memory contents. 


Finally, implementations of the PowerPC Architecture can exempt the machine check exception from 
context synchronization control. If the machine check exception is exempted, an instruction that 
precedes a context synchronizing operation can cause a machine check exception after the context 
synchronizing operation occurs and additional instructions have completed. 


The following scenarios use pseudocode examples to illustrate these limitations of context 
synchronization. Subsequent text explains how software can further guarantee “storage ordering.” 


1. Consider the following instruction sequence: 


STORE non-cachable to address XYZ 
isync 
XYZ instruction 
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In this sequence, the isync instruction does not guarantee that the XYZ instruction is fetched after 
the STORE has occurred to memory. There is no guarantee which XYZ instruction will execute; 
either the old version or the new (stored) version might. 


2. Consider the following instruction sequence, which assumes that a PPC405 core is part of a 
standard product that uses DCRs to provide bus region control: 


STORE non-cachable to address XYZ 
isync 
MTDCR to change a bus region containing XYZ 


In this sequence, there is no guarantee that the STORE will occur before the mtdcr changing the 
bus region control DCR. The STORE could fail because of a configuration error. 


Consider an interrupt that changes privileged mode. An interrupt is a context synchronizing operation, 
because interrupts cause the MSR to be updated. The MSR is part of the processor context; the 
context synchronizing operation guarantees that all instructions that precede the interrupt complete 
using the preinterrupt value of MSR[PR], and that all instructions that follow the interrupt complete 
using the postinterrupt value. 


Consider, on the other hand, some code that uses mtmsr to change the value of MSR[PR], which 
changes the privileged mode. In this case, the MSR is changed, changing the context. It is possible, 
for example, that prefetched privileged instructions expect to execute after the mtmsr has changed 
the operating mode from privileged mode to user mode. To prevent privileged instruction program 
exceptions, the code must execute a context synchronization operation, such as isync, immediately 
after the mtmsr instruction to prevent further instruction execution until the mtmsr completes. 


eieio or sync can ensure that the contents of memory and DCRs are synchronized in the instruction 
stream. These instructions guarantee storage ordering because all memory accesses that precede 
eieio or sync are completed before subsequent memory accesses. Neither eieio nor sync guarantee 
that instruction prefetching is delayed until the eieio or sync completes. The instructions do not cause 
the prefetch queues to be purged and instructions to be refetched. See “Storage Synchronization” on 
page 2-35 for more information. 


Instruction cache state is part of context. A context synchronization operation is required to guarantee 
instruction cache access ordering. 


3. Consider the following instruction sequence, which is required for creating self-modifying code: 


STORE Change data cache contents 


dcbst Flush the new data cache contents to memory 

sync Guarantee that dcbst completes before subsequent instructions begin 

icbi Context changing operation; invalidates instruction cache contents. 

isync Context synchronizing operation; causes refetch using new instruction cache context 


text and new memory context, due to the previous sync. 


If software wishes to ensure that all storage accesses are complete before executing a mtdcr to 
change a bus region (Example 2), the software must issue a sync after all storage accesses and 
before the mtdcr. Likewise, if the software is to ensure that all instruction fetches after the mtdcr use 
the new bank register contents, the software must issue an isync, after the mtdcr and before the first 
instruction that should be fetched in the new context. 
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isync guarantees that all subsequent instructions are fetched and executed using the context 
established by all previous instructions. isyne is a context synchronizing operation; isyne causes all 
subsequently prefetched instructions to be discarded and refetched. 


The following example illustrates the use of isyne with debug exceptions: 


mtdbcrO Enable an instruction address compare (IAC) event 

isync Wait for the new Debug Control Register 0 (DBCRO) context to be established 

XYZ This instruction is at the IAC address; an isynce was necessary to guarantee that the 
IAC event occurs at the execution of this instruction 


2.10.2 Execution Synchronization 


For completeness, consider the definition of execution synchronizing as it relates to context 
synchronization. Execution synchronization is architecturally a subset of context synchronization. 


Execution synchronization guarantees that the following requirement is met: 


All instructions that precede an execution synchronizing operation must complete in the context 
that existed before the execution synchronizing operation. 


The following requirement need not be met: 


All instructions that follow an execution synchronizing operation must complete in the context that 
exists after the execution synchronizing operation. 


Execution synchronization ensures that preceding instructions execute in the old context; subsequent 
instructions might execute in either the new or old context (indeterminate). The PPC405 core provides 
three execution synchronizing operations: the eieio, mtmsr, and sync instructions. 


Because mtmsr is execution synchronizing, it guarantees that previous instructions complete using 
the old MSR value. (For example, using mtmsr to change the endian mode.) However, to guarantee 
that subsequent instructions use the new MSR value, we have to insert a context synchronization 
operation, such as isync. 


Note that the PowerPC Architecture requires MSR[EE] (the external interrupt bit) to be, in effect, 
execution synchronizing: if a mtmsr sets MSR[EE] = 1, and an external interrupt is pending, the 
exception must be taken before the instruction that follows mtmsr is executed. However, the mtmsr 
instruction is not a context synchronizing operation, so the PPC405 core does not, for example, 
discard prefetched instructions and refetch. Note that the wrtee and wrteei instructions can change 
the value of MSR[EE], but are not execution synchronizing. 


Finally, while syne and eieio are execution synchronizing, they are also more restrictive in their 
requirement of memory ordering. Stating that an operation is execution synchronizing does not imply 
storage ordering. This is an additional specific requirement of sync and eieio. 

2.10.3 Storage Synchronization 


The sync instruction guarantees that all previous storage references complete with respect to the 
PPC405 core before the sync instruction completes (therefore, before any subsequent instructions 
begin to execute). The sync instruction is execution synchronizing. 


Consider the following use of sync: 
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stw 
sync 
mtdcr 


The eieio instruction guarantees the order of storage accesses. All storage accesses that precede 
eieio complete before any storage accesses that follow the instruction, as in the following example: 


stb X 
eieio 
loz Y 


Store to peripheral 
Wait for store to actually complete 
Reconfigure device 


Store to peripheral, address X; this resets a status bit in the device 
Guarantee stb X completes before next instruction 
Load from peripheral, address Y; this is the status register updated by stb X. 


eieio was necessary, because the read and write addresses are different, but 
affect each other 


The PPC405 core implements both sync and eieio identically, in the manner described above for 
sync. In the PowerPC Architecture, syne can function across all processors in a multiprocessor 
environment; eieio functions only within its executing processor. The PPC405 does not provide 

hardware support for multiprocessor memory coherency, so sync does not guarantee memory 

ordering across multiple processors. 


2.11 


Instruction Set 


The PPC405 instruction set contains instructions defined in the PowerPC Architecture and 
instructions specific to the IBM PowerPC 400 family of embedded processors. 


Chapter 9, “Instruction Set,” contains detailed descriptions of each instruction. 


Appendix A, “Instruction Summary,’ alphabetically lists each instruction and extended mnemonic and 


provides a short-form description. Appendix B, “Instructions by Category,” provides short-form 
descriptions of instructions, grouped by the instruction categories listed in Table 2-10, “PPC405 
Instruction Set Summary,’ on page 2-36. 


Table 2-10 summarizes the PPC405 instruction set functions by categories. Instructions within each 


category are described in subsequent sections. 


Table 2-10. PPC405 Instruction Set Summary 


Storage Reference 


load, store 


Cache Management 


Arithmetic add, subtract, negate, multiply, multiply-accumulate, multiply halfword, divide 
Logical and, andc, or, orc, xor, nand, nor, xnor, sign extension, count leading zeros 
Comparison compare, compare logical, compare immediate 

Branch branch, branch conditional, branch to LR, branch to CTR 

CR Logical crand, crandc, cror, crorc, crnand, crnor, crxor, crxnor, move CR field 

Rotate rotate and insert, rotate and mask, shift left, shift right 

Shift shift left, shift right, shift right algebraic 


invalidate, touch, zero, flush, store, read 


Interrupt Control 


Processor Management 
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write to external interrupt enable bit, move to/from MSR, return from interrupt, 
return from critical interrupt 


system call, synchronize, trap, move to/from DCRs, move to/from SPRs, move 
to/from CR 
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2.11.1 Instructions Specific to the IBM PowerPC Embedded Environment 


To support functions required in embedded real-time applications, the IBM PowerPC 400 family of 
embedded processors defines instructions that are not defined in the PowerPC Architecture. 


Table 2-11 lists the instructions specific to IBM PowerPC embedded processors. Programs using 
these instructions are not portable to PowerPC implementations that are not part of the IBM PowerPC 
400 family of embedded processors. 


In the table, the syntax [s] indicates that the instruction has a signed form. The syntax [ul] indicates 
that the instruction has an unsigned form. The syntax “[.]’ indicates that the instruction has a “record” 
form that updates CR[CRO], and a “non-record” form. 


Table 2-11. Implementation-specific Instructions 


dccci macchw{s][u] | mulchw([u] mfdcr 
dcread machhw{s][u] | mulhhw[u] mtdcr 
iccci maclhw{s][u] mullhw([u] rfci 
icread nmacchwis] tlbre 
nmachhw{s] tlbsx[.] 
nmaclhw{[s] tlbwe 
wrtee 
wrteei 


2.11.2 Storage Reference Instructions 


Table 2-12 lists the PPC405 storage reference instructions. Load/store instructions transfer data 
between memory and the GPRs. These instructions operate on bytes, halfwords, and words. Storage 
reference instructions also support loading or storing multiple registers, character strings, and byte- 
reversed data. 


In the table, the syntax “[u]” indicates that an instruction has an “update” form that updates the RA 
addressing register with the calculated address, and a “non-update” form. The syntax “[x]” indicates 
that an instruction has an “indexed” form, which forms the address by adding the contents of the RA 
and RB GPRs and a “base + displacement” form, in which the address is formed by adding a 16-bit 
signed immediate value (included as part of the instruction word) to the contents of RA GPR. 


Table 2-12. Storage Reference Instructions 


Loads Stores 
Byte | Halfword| Word | Multiple/String| Byte | Halfword| Word | Multiple/String 
Ibz[uJ[x] | Iha[u][x] | lwarx Imw stb[u][x] | sth[u][x] | stw[u][x] | stmw 
Ihbrx Iwbrx Iswi sthbrx stwbrx | stswi 
Ihz[u][x] | lwz[u][x] | lswx stwex. stswx 
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2.11.3 Arithmetic Instructions 


Arithmetic operations are performed on integer operands stored in GPRs. Instructions that perform 
operations on two operands are defined in a three-operand format; an operation is performed on the 
operands, which are stored in two GPRs. The result is placed in a third, operand, which is stored in a 
GPR. Instructions that perform operations on one operand are defined using a two-operand format; 
the operation is performed on the operand in a GPR and the result is placed in another GPR. Several 
instructions also have immediate formats in which an operand is contained in a field in the instruction 
word. 


Most arithmetic instructions have versions that can update CR[CRO] and XER[SO, OV], based on the 
result of the instruction. Some arithmetic instructions also update XER[CA] implicitly. See “Condition 
Register (CR)” on page 2-10 and “Fixed Point Exception Register (XER)” on page 2-7 for more 
information. 


Table 2-13 lists the PPC405 arithmetic instructions. In the table, the syntax “[o]” indicates that an 
instruction has an “o” form that updates XER[SO,OV], and a “non-o” form. The syntax “[.]” indicates 
that the instruction has a “record” form that updates CR[CRO], and a “non-record” form. 


Table 2-13. Arithmetic Instructions 


Add Subtract Multiply Divide Negate 
add[o][.] subf[o][.] mulhw([.] divw(o][.] neg[o][.] 
addc[o][.] subfc[o][.] | mulhwu[.] | divwufo][.] 
adde[o][.] subfe[o][.] | mulli 
addi subfic mullw[o][.] 
addic[.] subfmef[o][.] 
addis subfze[o][.] 
addmef[o][.] 
addze[o][.] 
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Table 2-14 lists additional arithmetic instructions for multiply-accumulate and multiply halfword 
operations. In the table, the syntax “[o]” indicates that an instruction has an “o” form that updates 
XER[SO,OV], and a “non-o” form. The syntax “[.]” indicates that the instruction has a “record” form 
that updates CR[CRO], and a “non-record” form. 


Table 2-14. Multiply-Accumulate and Multiply Halfword Instructions 


Negative- 
Multiply- Multiply- Multiply 

Accumulate Accumulate Halfword 
macchw(o][.] nmacchw([o][.] mulchw/.] 
macchws[o][.] nmacchws[o][.] | mulchwu[.] 
macchwsu[o][.]_ | nmachhw(o][.] mulhhw{[.] 
macchwul[o][.] nmachhwsfo][.] | mulhhwu[.] 
machhwh[o][.] nmaclhwi[o][.] mullhw([.] 
machhws[o][.] nmaclhwsf[o][.] mullhwul[.] 
machhwsuf[o][.] 
machhwuf[o][.] 
maclhwi[o][.] 
maclhwsj[o][.] 
maclhwsu[o][.] 
maclhwu[o][.] 


2.11.4 Logical Instructions 


Table 2-15 lists the PPC405 logical instructions. In the table, the syntax “[.]’ indicates that the 
instruction has a “record” form that updates CR[CRO], and a “non-record” form. 


Table 2-15. Logical Instructions 


Count 

And with Or with leading 

And |complement| Nand | Or |complement| Nor | Xor | Equivalence zeros 

and[.] | andc[.] nand[.] | or[.] | orc[.] nor[.] | xor[.] | eqv[.] entlzw[.] 
andi. ori xori 
andis. oris xoris 


2.11.5 Compare Instructions 


These instructions perform arithmetic or logical comparisons between two operands and update the 
CR with the result of the comparison. 


Table 2-16 lists the PPC405 core compare instructions. 


Table 2-16. Compare Instructions 


Arithmetic | Logical 


cmp cmpl 
cmpi cmpli 
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2.11.6 Branch Instructions 


These instructions unconditionally or conditionally branch to an address. Conditional branch 
instructions can test condition codes set by a previous instruction and branch accordingly. Conditional 
branch instructions can also decrement and test the CTR as part of branch determination, and can 
save the return address in the LR. The target address for a branch can be a displacement from the 
current instruction address (a relative address), an absolute address, or contained in the CTR or LR. 


See “Branch Processing” on page 2-24 for more information on branch operations. 


Table 2-17 lists the PPC405 branch instructions. In the table, the syntax “[I]” indicates that the 
instruction has a “link update” form that updates LR with the address of the instruction after the 
branch, and a “non-link update” form. The syntax “[a]” indicates that the instruction has an “absolute 
address” form, in which the target address is formed directly using the immediate field specified as 
part of the instruction, and a “relative” form, in which the target address is formed by adding the 
immediate field to the address of the branch instruction). 


Table 2-17. Branch Instructions 


Branch 


b{!][a] 
be[I][a] 
bectr[l] 
belr{l] 


2.11.6.1 CR Logical Instructions 


These instructions perform logical operations on a specified pair of bits in the CR, placing the result in 
another specified bit. These instructions can logically combine the results of several comparisons 
without incurring the overhead of conditional branch instructions. Software performance can 
significantly improve if multiple conditions are tested at once as part of a branch decision. 


Table 2-18 lists the PPC405 condition register logical instructions. 


Table 2-18. CR Logical Instructions 


crand crnor 
crandc cror 
creqv crorc 
crnand crxor 
merf 


2.11.6.2 Rotate Instructions 


These instructions rotate operands stored in the GPRs. Rotate instructions can also mask rotated 
operands. 


Table 2-19 lists the PPC405 rotate instructions. In the table, the syntax “[.]’ indicates that the 
instruction has a “record” form that updates CR[CRO], and a “non-record” form. 


Table 2-19. Rotate Instructions 


Rotate and Insert | Rotate and Mask 


rlwimi(.] rlwinm[.] 
rlwnn.] 
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2.11.6.3 Shift Instructions 
These instructions rotate operands stored in the GPRs. 


Table 2-20 lists the PPC405 shift instructions. Shift right algebraic instructions implicitly update 
XER[CA]. In the table, the syntax “[.]” indicates that the instruction has a “record” form that updates 
CR[CRO], and a “non-record” form. 


Table 2-20. Shift Instructions 


Shift Right 
Shift Left | Shift Right | Algebraic 
slw[.] srw[.] sraw|[.] 

srawi(.] 


2.11.6.4 Cache Management Instructions 


These instructions control the operation of the ICU and DCU. Instructions are provided to fill or 
invalidate instruction cache blocks. Instructions are also provided to fill, flush, invalidate, or zero data 
cache blocks, where a block is defined as a 32-byte cache line. 


Table 2-21 lists the PPC405 core cache management instructions. 
Table 2-21. Cache Management Instructions 


DCU ICU 
dcba icbi 


dcbf 
dcbi 
dcbst 


icbt 
iccci 
icread 


dcbt 
dcbtst 
dcbz 
dccci 
dcread 


2.11.7 Interrupt Control Instructions 


mfmsr and mtmsr read and write data between the MSR and a GPR to enable and disable 
interrupts. wrtee and wrteei enable and disable external interrupts. rfi and rfci return from interrupt 
handlers. Table 2-22 lists the PPC405 core interrupt control instructions. 


Table 2-22. Interrupt Control Instructions 


mfmsr 
mtmsr 
rfi 

rfci 
wrtee 
wrteei 
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2.11.8 TLB Management Instructions 


The TLB management instructions read and write entries of the TLB array in the MMU, search the 
TLB array for an entry which will translate a given address, and invalidate all TLB entries. There is 
also an instruction for synchronizing TLB updates with other processors, but because the PPC405 
core is for use in uniprocessor environments, this instruction performs no operation. 


Table 2-23 lists the TLB management instructions. In the table, the syntax “[.]” indicates that the 
instruction has a “record” form that updates CR[CRO], and a “non-record” form. 


Table 2-23. TLB Management Instructions 


tlbia 
tlbre 
tlbsx[.] 
tlbsync 
tlbwe 


2.11.9 Processor Management Instructions 


These instructions move data between the GPRs and SPRs, the CR, and DCRs in the PPC405 core, 
and provide traps, system calls, and synchronization controls. 


Table 2-24 lists the processor management instructions in the PPC405 core. 


Table 2-24. Processor Management Instructions 


eieio merxr mtcrf 
isync mfcr mtdcer 
sync mfdcer mtspr 
mfspr sc 
tw 
twi 


2.11.10 Extended Mnemonics 


In addition to mnemonics for instructions supported directly by hardware, the PowerPC Architecture 
defines numerous extended mnemonics. 


An extended mnemonic translates directly into the mnemonic of a hardware instruction, typically with 
carefully specified operands. For example, the PowerPC Architecture does not define a “shift right 
word immediate” instruction, because the “rotate left word immediate then AND with mask,” (rlwinm) 
instruction can accomplish the same result: 


rlwinm RA,RS,32-n,n,31 


However, because the required operands are not obvious, the PowerPC Architecture defines an 
extended mnemonic: 


srwi RA,RS,n 


Extended mnemonics transfer the problem of remembering complex or frequently used operand 
combinations to the assembler, and can more clearly reflect a programmer's intentions. Thus, 
programs can be more readable. 
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Refer to the following chapter and appendixes for lists of the extended mnemonics: 


¢ Chapter 9, “Instruction Set,” lists extended mnemonics under the associated hardware instruction 
mnemonics. 


¢ Appendix A, “Instruction Summary,” lists extended mnemonics alphabetically, along with the 
hardware instruction mnemonics. 


* Table B-5 in Appendix B, “Instructions by Category,’ lists all extended mnemonics. 
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Chapter 3. Initialization 


This chapter describes reset operations, the initial state of the PPC405 core after a reset, and an 
example of the initialization code required to begin executing application code. Initialization of external 
system components or system-specific chip facilities may also be performed, in addition to the basic 
initialization described in this chapter. 


Reset operations affect the PPC405 at power on time as well as during normal operation, if 
programmed to do so. To understand how these operations work it is necessary to first understand 
the signal pins involved as well as the terminology of core, chip and system resets. Three types of 
reset, each with different scope, are possible in the PPC405. A core reset affects only the processor 
core. Chip resets affect the processor core and all on-chip peripherals. System resets affect the 
processor core, all on-chip peripherals, and any off-chip devices connected to the chip reset net. Only 
the processor core can request a core or chip reset. 


The processor core can request three types of processor resets: core, chip, and system. Each type of 
reset can be generated by a JTAG debug tool, by the second expiration of the watchdog timer, or by 
writing a non-zero value to the Reset (RST) field of Debug Control Register 0 (DBCRO). In 
Core+ASIC and system on chip (SOC) designs, reset signals from on-chip and external peripherals 
can initiate system resets. 


Core reset Resets the processor core, including the data cache unit (DCU) and instruction 
cache unit (ICU). 
Chip reset Resets the processor core, including the DCU and ICU. This type of reset is 


provided in the IBM PowerPC 400 Series Embedded controllers as a means of 
resetting on-chip peripherals, and is provided on the PPC405 for compatibility. 


System reset Resets the entire chip. The reset signal is driven active by the PPC405 during 
system reset. 


The effects of core and chip resets on the processor core are identical. To determine which reset type 
occurred, the most-recent reset (MRR) field of the Debug Status Register (DBSR) can be examined. 


3.1 Processor State After Reset 


After a reset, the contents of the Machine State Register (MSR) and the Special Purpose Registers 
(SPRs) control the initial processor state. The contents of Device Control Registers (DCRs) control 
the initial states of on-chip devices. Chapter 10, “Register Summary,’ contains descriptions of the 
registers. 


In general, the contents of SPRs are undefined after a reset. Reset initializes the minimum number of 
SPR fields required for allow successful instruction fetching. “Contents of Special Purpose Registers 
after Reset” on page 3-3 describes these initial values. System software fully configures the 
processor. 


“Machine State Register Contents after Reset” on page 3-2 describes the MSR contents. 


The MCI field of the Exception Syndrome Register (ESR) is cleared so that it can be determined if 
there has been a machine check during initialization, before machine check exceptions are enabled. 
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Two SPRs contain status on the type of reset that has occurred. The Debug Status Register (DBSR) 
contains the most recent reset type. The Timer Status Register (TSR) contains the most recent 
watchdog reset. 


3.1.1. Machine State Register Contents after Reset 


After all resets, all fields of the Machine State Register (MSR) contain zeros. Table 3-1 shows how 
this affects core operation. 


Table 3-1. MSR Contents after Reset 


Core Chip System 
Register | Field Reset Reset Reset Comment 
MSR AP 0 0 0 APU unavailable 
APE 0 0 0 Auxiliary processor exception disabled 
WE 0 0 0 Wait state disabled 
CE 0 0 0 Critical interrupts disabled 
EE 0 0 0 External interrupts disabled 
PR 0 0 0 Supervisor mode 
FP 0 0 0 Floating point unavailable 
ME 0 0 0 Machine check exceptions disabled 
FEO 0 0 0 Floating point exception disabled 
DWE 0 0 0 Debug wait mode disabled 
DE 0 0 0 Debug interrupts disabled 
FE1 0 0 0 Floating point exceptions disabled 
DR 0 0 0 Data translation disabled 
IR 0 0 0 Instruction translation disabled 
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3.1.2 Contents of Special Purpose Registers after Reset 


In general, the contents of Special Purpose Registers (SPRs) are undefined after a core, chip, or 
system reset. Some SPRs retain the contents they had before a reset occurred. 


Table 3-2 shows the contents of SPRs that are defined or unchanged after core, chip, and system 


resets. 
Table 3-2. SPR Contents After Reset 
Register | Bits/Fields Core Reset Chip Reset System Reset Comment 
CCRO 0:31 0x00700000 0x00700000 0x00700000 Sets ICU and DCU PLB 
priorities 
DBCRO |EDM 0 0 0 External debug mode 
disabled 
RST 00 00 00 No reset action. 
DBCR1 | 0:31 0x00000000 0x00000000 0x00000000 Data compares disabled 
DBSR MRR 01 10 11 Most recent reset 
DCCR $0:S31 0x0000 0000 0x00000000 0x00000000 Data cache disabled 
DCWR_ | W0:W31 0x00000000 0x00000000 0x00000000 Data cache write-through 
disabled 
ESR 0:31 0x00000000 0x00000000 0x00000000 No exception syndromes 
ICCR $0:S31 0x00000000 0x00000000 0x00000000 Instruction cache disabled 
PVR 0:31 Processor version 
SGR G0:G31 OxFFFFFFFF OxFFFF FFFF OxFFFF FFFF Storage is guarded 
SLER $0:S31 0x0000 0000 0x00000000 0x00000000 Storage is big endian 
SUOR K0:K31 0x00000000 0x00000000 0x00000000 Storage is uncompressed 
TCR WRC 00 00 00 Watchdog timer reset disabled 
TSR WRS Copy of Copy of Copy of Watchdog reset status 
TCR[WRC] TCR[WRC] TCR[WRC] 
PIS Undefined Undefined Undefined After POR 
FIS Unchanged Unchanged Unchanged If reset not caused by 
watchdog timer 
3.2 PPC405 Initial Processor Sequencing 


After any reset, the processor core fetches the word at address OxFFFFFFFC and attempts to 
execute it. The instruction at OXFFFFFFFC is typically a branch to initialization code. Unless the 
instruction at OxFFFFFFFC is an unconditional branch, fetching can wrap to address 0x00000000 


and attempt to execute the instruction at this location. 
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Because the processor is initially in big endian mode, initialization code must be in big endian format 
until the endian storage attribute for the addressed region is changed, or until code branches to a 
region defined as little endian storage. 


Before a reset operation begins, the system must provide non-volatile memory, or memory initialized 
by some mechanism external to the processor. This memory must be located at address 
OxFFFFFFFC. 


3.3 Initialization Requirements 


When any reset is performed, the processor is initialized to a minimum configuration to start executing 
initialization code. Initialization code is necessary to complete the processor and system 
configuration. 


The initialization code example in this section performs the configuration tasks required to prepare the 
PPC405 core to boot an operating system or run an application program. 


Some portions of the initialization code work with system components that are beyond the scope of 
this manual. 


Initialization code should perform the following tasks to configure the processor resources. 


To improve instruction fetching performance: initialize the SGR appropriately for guarded or 
unguarded storage. Since all storage is initially guarded and speculative fetching is inhibited to 
guarded storage, reprogramming the SGR will improve performance for unguarded regions. 


1. Before executing instructions as cachable: 


— Invalidate the instruction cache. 
— Initialize the ICCR to configure instruction cachability. 


2. Before using storage access instructions: 


Invalidate the data cache. 

Initialize CRRO to determine if a store miss results in a line fill (SWOA). 
Initialize the DCWR to select copy-back or write-through caching. 
Initialize the DCCR to configure data cachability. 


3. Before allowing interrupts (synchronous or asynchronous): 


— Initialize the EVPR to point to vector table. 
— Provide vector table with branches to interrupt handlers. 


4. Before enabling asynchronous interrupts: 


— Initialize timer facilities. 
— Initialize MSR to enable appropriate interrupts. 


5. Initialize other processor features, such as the MMU, APU (if implemented), debug, and trace. 
6. Initialize non-processor resources. 


— Initialize system memory as required by the operating system or application code. 
— Initialize off-chip system facilities. 


7. Start the execution of operating system or application code. 
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3. 


The following initialization code illustrates the steps that should be taken to initialize the processor 


4 Initialization Code Example 


before an operating system or user programs begin execution. The example is presented in pseudo- 


code; function calls are named similarly to PPC405 mnemonics where appropriate. Specific 
implementations may require different ordering of these sections to ensure proper operation. 


hs */ 
/* PPC405 Initialization Pseudo Code *) 
[® */ 
@OxFFFFFFFC: /* initial instruction fetch from OxFFFFFFFC */ 
ba(init_code); /* branch to initialization code */ 
@init_code: 
[* */ 
/* Configure guarded attribute for performance. a) 
[* */ 
mtspr(SGR, guarded_attribute); 
fF i. 
/* Configure endianness and compression. */ 
[* */ 


mtspr(SLER, endianness); 
mtspr(SUOR, compression_attribute); 


is *f 
/* Invalidate the instruction cache and enable cachability —*/ 
re */ 
iccci; /* invalidate i-cache */ 

mtspr(ICCR, i_cache_cachability); /* enable I-cache*/ 
isync; 
[* */ 
/* Invalidate the data cache and enable cachability */ 
r* */ 
address = 0; /* start at first line af 


for (line = 0; line <m_lines; line++) | /* D-cache has m_lines congruence classes a 


{ 


dccci(address); /* invalidate congruence class th 
address += 32; /* point to the next congruence class ap 
} 
mtspr(CCRO, store-miss_line-fill); 
mtspr(DCWR, copy-back_write-thru); 
mtspr(DCCR, d_cache_cachability); /* enable D-cache */ 
isync; 
/* *f 
/* Prepare system for synchronous interrupts. */ 
fe ef 
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mtspr(EVPR, prefix_addr); /* initialize exception vector prefix | 


/* Initialize vector table and interrupt handlers if not already done */ 


/* \nitialize and configure timer facilities */ 
mtspr(PIT, 0); /* clear PIT so no PIT indication after TSR cleared*/ 
mtspr(TSR, OxFFFFFFFF); /* clear TSR */ 
mtspr(TCR, timer_enable); /* enable desired timers */ 
mtspr(TBL, 0); /* reset time base low first to avoid ripple */ 
mtspr(TBU, time_base_u); /* set time base, hi first to catch possible ripple */ 
mtspr(TBL, time_base_l); /* set time base, low */ 
mtspr(PIT, pit_count); /* set desired PIT count */ 
/* Initialize the MSR */ 
i */ 
/* Exceptions must be enabled immediately after timer facilities to avoid missinga  */ 
/* timer exception. a 
[* ui 
/* The MSR also controls privileged/user mode, translation, and the wait state. */ 
/* These must be initialized by the operating system or application code. */ 
/* \f enabling translation, code must initialize the TLB. th 
i */ 


mtmsr(machine_state); 


I */ 
/* Initialization of other processor facilities should be performed at this time. *} 
* */ 
i */ 
/* \nitialization of non-processor facilities should be performed at this time. *h 
ie */ 
ik */ 
/* Branch to operating system or application code can occur at this time. *} 
ik */ 
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Chapter 4. Cache Operations 


The PPC405 core incorporates two internal cache units, an instruction cache unit (ICU) anda data 
cache unit (DCU). Instructions and data can be accessed in the caches much faster than in main 
memory, if instruction and data cache arrays are implemented. The PPC405B3 core has a 16KB 
instruction cache array and an 8KB data cache array. 


The ICU controls instruction accesses to main memory and, if an instruction cache array is 
implemented, stores frequently used instructions to reduce the overhead of instruction transfers 
between the instruction pipeline and external memory. Using the instruction cache minimizes access 
latency for frequently executed instructions. 


The DCU controls data accesses to main memory and, if a data cache array is implemented, stores 
frequently used data to reduce the overhead of data transfers between the GPRs and external 
memory. Using the data cache minimizes access latency for frequently used data. 


The ICU features: 

¢ Programmable address pipelining and prefetching for cache misses and non-cachable lines 
¢ Support for non-cachable hits from lines contained in the line fill buffer 

« Programmable non-cachable requests to memory as 4 or 8 words (or half line or line) 

¢ Bypass path for critical words 

¢ Non-blocking cache for hits during fills 

¢ Flash invalidate (one instruction invalidates entire cache) 


« Programmable allocation for fetch fills, enabling program control of cache contents using the icbt 
instruction 


¢ Virtually indexed, physically tagged cache arrays 
¢ Arich set of cache control instructions 
The DCU features: 


¢ Address pipelining for line fills 

¢ Support for load hits from non-cachable and non-allocated lines contained in the line fill buffer 
¢ Bypass path for critical words 

¢ Non-blocking cache for hits during fills 

¢ Write-back and write-through write strategies controlled by storage attributes 

¢ Programmable non-cachable load requests to memory as lines or words. 

¢ Handling of up to two pending line flushes. 

¢ Holding of up to three stores before stalling the core pipeline 

« Physically indexed, physically tagged cache arrays 

¢ Arich set of cache control instructions 
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The PPC405 core can include an instruction cache array and a data cache array. The size of the 
cache arrays can vary by core implementation, as shown in Table 4-1. 


Table 4-1. Available Cache Array Sizes 


ICU Cache Array Size | DCU Cache Array Size 


4KB 4KB 
8KB 8KB 


16KB 16KB 


32KB 32KB 


Programming Note: If the ICU cache array or the DCU cache array is not present (OKB), the | 
(cachability) storage attribute must be turned off for instruction-side or data-side memory, 
respectively. 


“ICU and DCU Organization and Sizes” describes the organization and sizes of the ICU and the DCU. 
“ICU Overview” on page 4-3 and “DCU Overview” on page 4-6 provide overviews of the ICU and 
DCU. 


4.1. ICU and DCU Organization and Sizes 


The ICU and DCU contain control logic and, in some implementations, cache arrays. The control 
logic, which handles data transfers between the cache units, main memory, and the RISC core, differs 
significantly between the ICU and DCU. The ICU and DCU cache arrays, which (when implemented) 
store instructions and data from main memory, respectively, are almost identical. (The DCU array 
adds a “dirty” bit to mark modified lines.) 


The ICU and DCU cache arrays are two-way set-associative. In both cache units, a cache line can be 
in one of two locations in the cache array. The two locations are members of a set of locations. Each 
set is divided into two ways, way A and way B; a cache line can be located in either way. Each way is 
organized as nlines of eight words each, where nis the cache size, in kilobytes, multiplied by 16. For 
example, a 4KB cache array contains 64 lines. 


Cache lines are addressed using a tag field and an index. The tag fields are also two-way set- 
associative. As shown in Table 4-2, the tag fields in ways A and B store address bits Ag.2; for each 
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cache line. The remaining address bits (Azo.97) serve as an index to the cache array. The two cache 
lines that correspond with the same line index are called a congruence class. 


Table 4-2. ICU and DCU Cache Array Organization 


Tags (Two-way Set) Cache Lines (Two-way Set) 


Way A Way B Way A Way B 


Aop:m—1 Line n- 2 Aop:m—1 Line n- 2 Line n—2 Line n—2 


Aop:m_ 4 Line n-1 Ao:m—1 Line n-1 Line n—1 Line n—1 


Table 4-3 shows the values of m and n for various cache array sizes. 


Table 4-3. Cache Sizes, Tag Fields, and Lines 


Instruction Cache Array Data Cache Array 
Array Size | m (Tag Field Bits) n (Lines) m (Tag Field Bits) n (Lines) 
OKB — — 
4KB 22 (0:21) ) 64 
8KB 22 (0:21) ) 128 
16KB 22 (0:21) ) 256 
32KB 22 (0:21) 512 20 (0:19) 512 


When the ICU or DCU requests a cache line from main memory (an operation called a cache line fill), 
a least-recently-used (LRU) policy determines which cache line way will receive the requested line. 
The index, determined by the instruction or data address, selects a congruence class. Within a 
congruence class, the most recently accessed line (in either way A or way B) is retained and the LRU 
bit in the associated tag array marks the other line as LRU. The LRU line then receives the requested 
instruction or data words. After the cache line fill, the LRU bit is set to identify as LRU the line opposite 
the line just filled. 


4.2 ICU Overview 


The ICU manages instruction transfers between external cachable memory and the instruction queue 
in the execution unit. 
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Figure 4-1 shows the relationships between the ICU and the instruction pipeline. 


Instructions 


Addresses 
Instruction 
‘ Arrays 


Addresses from Fetcher 


Bypass Path 


Instruction Queue 


Figure 4-1. Instruction Flow 


4.2.1. ICU Operations 


Instructions from cachable memory regions are copied into the instruction cache array, if an array is 
present. The fetcher can access instructions much more quickly from a cache array than from 
memory. Cache lines can be loaded either target-word-first or sequentially, or in any order. Target- 
word-first fills start at the requested word, continue to the end of the line, and then wrap to fill the 
remaining words at the beginning of the line. Sequential fills start at the first word of the cache line 
and proceed sequentially to the last word of the line. 


The bypass path handles instructions in cache-inhibited memory and improves performance during 
line fill operations. If a request from the fetcher obtains an entire line from memory, the queue does 
not have to wait for the entire line to reach the cache. The target word (the word requested by the 
fetcher) is sent on the bypass path to the queue while the line fill proceeds, even if the selected line fill 
order is not target-word-first. 


Cache line fills always run to completion, even if the instruction stream branches away from the rest of 
the line. As requested instructions are received, they go to the fetcher from the fill register before the 
line fills in the cache. The filled line is always placed in the ICU; if an external memory subsystem 
error occurs during the fill, the line is not written to the cache. During a clock cycle, the ICU can send 
two instruction to the fetcher. 
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4.2.2 Instruction Cachability Control 


When instruction address translation is enabled (MSR[IR] = 1), instruction cachability is controlled by 
the | storage attribute in the translation lookaside buffer (TLB) entry for the memory page. If 
TLB_entry[l] = 1, caching is inhibited; otherwise caching is enabled. Cachability is controlled 
separately for each page, which can range in size from 1KB to 16MB. “Translation Lookaside Buffer 
(TLB)” on page 7-2 describes the TLB. 


When instruction address translation is disabled (MSR[IR] = 0), instruction cachability is controlled by 
the Instruction Cache Cachability Register (ICCR). Each field in the ICCR (ICCR[S0:S31]) controls 
the cachability of a 128MB region (see “Real-Mode Storage Attribute Control” on page 7-17). If 
ICCR[Sn] = 1, caching is enabled for the specified region; otherwise, caching is inhibited. 


The performance of the PPC405 core is significantly lower while fetching instructions from cache- 
inhibited regions. 


Following system reset, address translation is disabled and all ICCR bits are reset to 0 so that no 
memory regions are cachable. Before regions can be designated as cachable, the ICU cache array 
must be invalidated, if an array is present. The iccci instruction must execute before the cache is 
enabled. Address translation can then be enabled, if required, and the TLB or the ICCR can then be 
configured for the required cachability. 


4.2.3 Instruction Cache Synonyms 


The following information applies only if instruction address translation is enabled (MSR[IR] = 1) and 
1KB or 4KB page sizes are used. See Chapter 7, “Memory Management,” for information about 
address translation and page sizes. 


An instruction cache synonym occurs when the instruction cache array contains multiple cache lines 
from the same real address. Such synonyms result from combinations of: 


¢ Cache array size 

* Cache associativity 

« Page size 

¢ The use of effective addresses (EAs) to index the cache array 


For example, the instruction cache array has a "way size" of 8KB (16KB array/2 ways). Thus, 11 bits 
(EA19-29) are needed to select a word (instruction) in each way. For the minimum page size of 1KB, 
the low order 8 bits (EAo9.09) address a word in a page. The high order address bits (EAp-2;) are 
translated to form a real address (RA), which the ICU uses to perform the cache tag match. Cache 
synonyms could occur because the index bits (EAj9-29) overlap the translated RA bits. For 1KB 
pages, overlap in EAy9.9; and RAjg-9; could result in as many as 8 synomyms. In other words, data 
from the same RA could occur as many as 8 locations in the cache array. Similarly, for 4KB pages, 
EAo-19 are translated. Differences in EA;g and RAjg could result in as many as 2 synonyms. For the 
next largest page size (16KB), only EA 9.17 are translated. Because there is no overlap with index bits 
EA49-21, synonyms do not occur. 
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In practice, cache synonyms occur when a real instruction page having multiple virtual mappings 
exists in multiple cache lines. For 1KB pages, all EAs differing in EA;9.01 must be cast out of cache, 
using an icbi instruction for each such EA (up to 8 per cache line in the page). For 4KB pages, all EAs 
differing in EA;g must be cast out in the same manner (up to 2 per cache line in the page). For larger 
pages, cache synonyms do not occur, and casting out any of the multiple EAs removes the physical 
information from the cache. 


Programming Note: To prevent the occurrence of cache synonyms, use only page sizes greater 
than the cache way size (8KB), if possible. For the PPC405, the minimum such page size is 16KB. 
4.2.4 ICU Coherency 


The ICU does not “snoop” external memory or the DCU. Programmers must follow special 
procedures for ICU synchronization when self-modifying code is used or if a peripheral device 
updates memory containing instructions. 


The following code example illustrates the necessary steps for self-modifying code. This example 
assumes that adadr7 is both data and instruction cachable. 


stw regN, addri _# the data in regN is to become an instruction at addr1 
dcbst adar1 # forces data from the data cache to memory 
sync # wait until the data actually reaches the memory 
icbi adar1 # the previous value at addri might already be in 
the instruction cache; invalidate it in the cache 
isync # the previous value at addr1 may already have been 


pre-fetched into the queue; invalidate the queue 
so that the instruction must be re-fetched 


4.3 DCU Overview 


The DCU manages data transfers between external cachable memory and the general-purpose 
registers in the execution unit. 


A bypass path handles data operations in cache-inhibited memory and improves performance during 
line fill operations. 


4.3.1 DCU Operations 


Data from cachable memory regions are copied from external memory into lines in the data cache 
array so that subsequent cache operations result in cache hits. Loads and stores that hit in the DCU 
are completed in one cycle. For loads, GPRs receive the requested byte, halfword, or word of data 
from the data cache array. The DCU supports byte-writeability to improve the performance of byte and 
halfword store operations. 


Cache operations require a line fill wnen they require data from cachable memory regions that are not 
currently in the DCU. A line fill is the movement of a cache line (eight words) from external memory to 
the data cache array. Eight words are copied from external memory into the fill buffer, either target- 
word-first or sequentially, or in any other order. Loading order is controlled by the PLB slave. Target- 
word-first fills start at the requested word, continue to the end of the line, and then wrap to fill the 
remaining words at the beginning of the line. Sequential fills start at the first word of the cache line 
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and proceed sequentially to the last word of the line. In both types of fills, the fill buffer, when full, is 
transferred to the data cache array. The cache line is marked valid when it is filled. 


Loads that result in a line fill, and loads from non-cachable memory, are sent to a GPR. The 
requested byte, halfword, or word is sent from the DCU to the GPR from the fill buffer, using a cache 
bypass mechanism. Additional loads for data in the fill buffer can be bypassed to the GPR until the 
data is moved into the data array. 


Stores that result in a line fill have their data held in the fill buffer until the line fill completes. Additional 
stores to the line being filled will also have their data placed in the fill buffer before being transferred 
into the data cache array. 


To complete a line fill, the DCU must access the tag and data arrays. The tag array is read to 
determine the tag addresses, the LRU line, and whether the LRU line is dirty. A dirty cache line is one 
that was accessed by a store instruction after the line was established, and can be inconsistent with 
external memory. If the line being replaced is dirty, the address and the cache line must be saved so 
that external memory can be updated. During the cache line fill, the LRU bit is set to identify the line 
opposite the line just filled as LRU. 


When a line fill completes and replaces a dirty line, a line flush begins. A flush copies updated data in 
the data cache array to main storage. Cache flushes are always sequential, starting at the first word 
of the cache line and proceeding sequentially to the end of the line. 


Cache lines are always completely flushed or filled, even if the program does not request the rest of 
the bytes in the line, or if a bus error occurs after a bus interface unit accepts the request for the line 
fill. If a bus error occurs during a line fill, the line is filled and the data is marked valid. However, the 
line can contain invalid data, and a machine check exception occurs. 


4.3.2 DCU Write Strategies 


DCU operations can use write-back or write-through strategies to maintain coherency with external 
cachable memory. 


The write-back strategy updates only the data cache, not external memory, during store operations. 
Only modified data lines are flushed to external memory, and then only when necessary to free up 
locations for incoming lines, or when lines are explicitly flushed using dcebf or dcbst instructions. The 
write-back strategy minimizes the amount of external bus activity and avoids unnecessary contention 
for the external bus between the ICU and the DCU. 


The write-back strategy is contrasted with the write-through strategy, in which stores are written 
simultaneously to the cache and to external memory. A write-through strategy can simplify 
maintaining coherency between cache and memory. 


When data address translation is enabled (MSR[DR] = 1), the W storage attribute in the TLB entry for 
the memory page controls the write strategy for the page. If TLB_entry[W] = 0, write-back is selected; 
otherwise, write-through is selected. The write strategy is controlled separately for each page. 
“Translation Lookaside Buffer (TLB)” on page 7-2 describes the TLB. 


When data address translation is disabled (MSR[DR] = 0), the Data Cache Write-through Register 
(DCWR) sets the storage attribute. Each bit in the DOWR (DCWR[W0:W31]) controls the write 
strategy of a 128MB storage region (see “Real-Mode Storage Attribute Control” on page 7-17). If 
DCWR[Wn] = 0, write-back is enabled for the specified region; otherwise, write-through is enabled. 


Programming Note: The PowerPC Architecture does not support memory models in which 
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write-through is enabled and caching is inhibited. 


4.3.3. DCU Load and Store Strategies 
The DCU can control whether a load receives one word or one line of data from main memory. 


For cachable memory, the load without allocate (LWOA) field of the CCRO controls the type of load 
resulting from a load miss. If CCRO[LWOA] = 0, a load miss causes a line fill. lf CCRO[LWOA] = 1, 
load misses do not result in a line fill, but in a word load from external memory. For infrequent reads of 
non-contiguous memory, setting CCRO[LWOA] = 1 may provide a small performance improvement. 


For non-cachable memory and for loads misses when CCRO[LWOA] = 1, the load word as line (LWL) 
field in the CCRO affects whether load misses are satisfied with a word, or with eight words (the 
equivalent of a cache line) of data. If CCRO[LWL] = 0, only the target word is bypassed to the core. If 
CCRO[LWL] = 1, the DCU saves eight words (one of which is the target word) in the fill buffer and 
bypasses the target data to the core to satisfy the load word request. The fill buffer is not written to the 
data cache array. 


Setting CCRO[LWL] = 1 provides the fastest accesses to sequential non-cachable memory. 
Subsequent loads from the same line are bypassed to the core from the fill buffer and do not result in 
additional external memory accesses. The load data remains valid in the fill buffer until one of the 
following occurs: the beginning of a subsequent load that requires the fill buffer, a store to the target 
address, a dcbi or dccci instruction issued to the target address, or the execution of a sync 
instruction. Non-cachable loads to guarded storage never cause a line transfer on the PLB even if 
CCRO[LWL] = 1. Subsequent loads to the same non-cachable storage are always requested again 
from the PLB. 


For cachable memory, the store without allocate (SWOA) field of the CCRO controls the type of store 
resulting from a store miss. If CCRO[SWOA] = 0, a store miss causes a line fill. If CCRO[SWOA] = 1, 
store misses do not result in a line fill, but in a single word store to external memory. 


4.3.4 Data Cachability Control 


When data address translation is disabled (MSR[DR] = 0), data cachability is controlled by the Data 
Cache Cachability Register (DCCR). Each bit in the DOCR (DCCR[S0:S31]) controls the cachability 
of a 128MB region (see “Real-Mode Storage Attribute Control” on page 7-17). lf DCCR[Sn] = 1, 
caching is enabled for the specified region; otherwise, caching is inhibited. 


When data address translation is enabled (MSR[DR] = 1), data cachability is controlled by the | bit in 
the TLB entry for the memory page. If TLB_entry[lI] = 1, caching is inhibited; otherwise caching is 
enabled. Cachability is controlled separately for each page, which can range in size from 1KB to 
16MB. “Translation Lookaside Buffer (TLB)” on page 7-2 describes the TLB. 


Programming Note: The PowerPC Architecture does not support memory models in which 
write-through is enabled and caching is inhibited. 


The performance of the PPC405 core is significantly lower while accessing memory in cache- 
inhibited regions. 


Following system reset, address translation is disabled and all DCCR bits are reset to 0 so that no 
memory regions are cachable. If an array is present, the dccci instruction must execute n times 
before regions can be designated as cachable. This invalidates all congruence classes before 
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enabling the cache. Address translation can then be enabled, if required, and the TLB or the DCCR 
can then be configured for the desired cachability. 


Programming Note: If a data block corresponding to the effective address (EA) exists in the 
cache, but the EA is non-cachable, loads and stores (including dcbz) to that address are 
considered programming errors (the cache block should previously have been flushed). The only 
instructions that can legitimately access such an EA in the data cache are the cache 
management instructions dcbf, dcbi, dcbst, dcbt, dcbtst, dccci, and dcread. 


4.3.5 DCU Coherency 


The DCU does not provide snooping. Application programs must carefully use cache-inhibited 
regions and cache control instructions to ensure proper operation of the cache in systems where 
external devices can update memory. 


4.4 Cache Instructions 


For detailed descriptions of the instructions described in the following sections, see Chapter 9, 
“Instruction Set.” 


In the instruction descriptions, the term “block” is synonymous with cache line. A block is the unit of 
storage operated on by all cache block instructions. 
4.4.1. ICU Instructions 


The following instructions control instruction cache operations: 


icbi Instruction Cache Block Invalidate 


Invalidates a cache block. 
icbt Instruction Cache Block Touch 


Initiates a block fill, enabling a program to begin a cache block fetch before the 
program needs an instruction in the block. 


The program can subsequently branch to the instruction address and fetch the 
instruction without incurring a cache miss. 


This is a privileged instruction. 
iccci Instruction Cache Congruence Class Invalidate 


Invalidates the instruction cache array. 


This is a privileged instruction. 
icread Instruction Cache Read 


Reads either an instruction cache tag entry or an instruction word from an 
instruction cache line, typically for debugging. Fields in CCRO control instruction 
behavior (see “Cache Control and Debugging Features” on page 4-11). 


This is a privileged instruction. 
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4.4.2. DCU Instructions 


Data cache flushes and fills are triggered by load, store and cache control instructions. Cache control 
instructions are provided to fill, flush, or invalidate cache blocks. 


The following instructions control data cache operations. 


dcba 


dcbf 


dcbi 


dcbst 


dcbt 


dcbist 
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Data Cache Block Allocate 
Speculatively establishes a line in the cache and marks the line as modified. 


If the line is not currently in the cache, the line is established and marked as 
modified without actually filling the line from external memory. 


If dcba references a non-cachable address, dcba is treated as a no-op. 


If dcba references a cachable address, write-through required (which would 
otherwise cause an alignment exception), dcba is treated as a no-op. 


Data Cache Block Flush 


Flushes a line, if found in the cache and marked as modified, to external memory; 
the line is then marked invalid. 


If the line is found in the cache and is not marked modified, the line is marked invalid 
but is not flushed. 


This operation is performed regardless of whether the address is marked cachable. 
Data Cache Block Invalidate 


Invalidates a block, if found in the cache, regardless of whether the address is 
marked cachable. Any modified data is not flushed to memory. 


This is a privileged instruction. 
Data Cache Block Store 


Stores a block, if found in the cache and marked as modified, into external memory; 
the block is not invalidated but is no longer marked as modified. 


If the block is marked as not modified in the cache, no operation is performed. 
This operation is performed regardless of whether the address is marked cachable. 
Data Cache Block Touch 


Fills a block with data, if the address is cachable and the data is not already in the 
cache. If the address is non-cachable, this instruction is a no-op. 


Data Cache Block Touch for Store 


Implemented identically to the debt instruction for compatibility with compilers and 
other tools. 
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dcbz 


dccci 


dcread 


Data Cache Block Set to Zero 
Fills a line in the cache with zeros and marks the line as modified. 


If the line is not currently in the cache (and the address is marked as cachable and 
non-write-through), the line is established, filled with zeros, and marked as modified 
without actually filling the line from external memory. If the line is marked as either 

non-cachable or write-through, an alignment exception results. 


Data Cache Congruence Class Invalidate 
Invalidates a congruence class (both cache ways). 
This is a privileged instruction. 

Data Cache Read 


Reads either a data cache tag entry or a data word from a data cache line, typically 
for debugging. Bits in CCRO control instruction behavior (see “Cache Control and 
Debugging Features” on page 4-11). 


This is a privileged instruction. 


4.5 Cache Control and Debugging Features 


Registers and instructions are provided to control cache operation and help debug cache problems. 
For ICU debug, the icread instruction and the Instruction Cache Debug Data Register (ICDBDR) are 
provided. See “ICU Debugging” on page 4-14 for more information. For DCU debug, the dcread 
instruction is provided. See “DCU Debugging” on page 4-15 for more information. 


CCRO controls the behavior of the icread and the dcread instructions. 


LWL SWOA _ IPP LBDE PFNC FWOA CWS 


5|6|7/8 9 [10 11]12]13) 14) 15] 16 19) 20)21)22)23)24 26/27/28 30/31 


t etal t 


LWOA DPP1 UOXE PFC NCRS CIS 


Figure 4-2. Core Configuration Register 0 (CCRO) 


Reserved 


6 LWL 


Load Word as Line 

0 The DCU performs load misses or non- 
cachable loads as words, halfwords, or 
bytes, as requested 

1 For load misses or non-cachable loads, 
the DCU moves eight words (including 
the target word) into the line fill buffer 


7 LWOA 


Load Without Allocate 

0 Load misses result in line fills 

1 Load misses do not result in a line fill, but 
in non-cachable loads 
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SWOA 


Store Without Allocate 

0 Store misses result in line fills 

1 Store misses do not result in line fills, but 
in non-cachable stores 


DPP1 


DCU PLB Priority Bit 1 Note: DCU logic dynamically controls DCU 
0 DCU PLB priority 0 on bit 1 priority bit 0. 
1 DCU PLB priority 1 on bit 1 


10:11 


IPP 


ICU PLB Priority Bits 0:1 

00 Lowest ICU PLB priority 

01 Next to lowest ICU PLB priority 
10 Next to highest ICU PLB priority 
11 Highest ICU PLB priority 


12:13 


Reserved 


UOXE 


Enable U0 Exception 
0 Disables the U0 exception 
1 Enables the U0 exception 


LDBE 


Load Debug Enable 

0 Load data is invisible on data-side (on- 
chip memory (OCM) 

1 Load data is visible on data-side OCM 


16:19 


Reserved 


20 


PFC 


ICU Prefetching for Cachable Regions 

0 Disables prefetching for cachable 
regions 

1 Enables prefetching for cachable regions 


21 


PFNC 


ICU Prefetching for Non-Cachable Regions 

0 Disables prefetching for non-cachable 
regions 

1 Enables prefetching for non-cachable 
regions 


22 


NCRS 


Non-cachable ICU request size 
0 Requests are for four-word lines 
1 Requests are for eight-word lines 


23 


FWOA 


Fetch Without Allocate 

0 An ICU miss results in a line fill. 

1 An ICU miss does not cause a line fill, 
but results in a non-cachable fetch. 


24:26 


Reserved 


27 


CIS 


Cache Information Select 
0 Information is cache data. 
1 Information is cache tag. 


28:30 


Reserved 


31 


CWS 


Cache Way Select 
0 Cache way is A. 
1 Cache way is B. 
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4.5.1 CCRO Programming Guidelines 


Several fields in CCRO affect ICU and DCU operation. Altering these fields while the cache units are 


involved in PLB transfers can cause errant operation, including a processor hang. 


To guarantee correct ICU and DCU operation, specific code sequences must be followed when 


altering CCRO fields. 


CCRO[IPP, FWOA] affect ICU operation. When these fields are altered, execution of the following 


code sequence (Sequence 1) is required. 


! SEQUENCE 1 Altering CCRO[IPP, FWOA] 
! Turn off interrupts 

mfmsr RM 

addis RZ,r0,0x0002 ! CE bit 

ori RZ,RZ,0x8000 ! EE bit 

andc RZ,RM,RZ — ! Turn off MSR[CE,EE] 
mtmsr RZ 

! sync 

sync 

! Touch code sequence into i-cache 

addis RX,r0,seqi@h 


ori RX,RX,seqi@l 
icbt r0,RX 

! Call function to alter CCRO bits 
b seq 

back: 


! Restore MSR to original value 
mtmsr RM 
e 
e 


! The following function must be in cacheable memory 


.align 5 ! Align CCRO altering code on a cache line boundary. 

seqi: 

icbt r0,RX ! Repeat ICBT and execute an ISYNC to guarantee CCRO 
isync ! altering code has been completely fetched across the PLB. 


mfspr RN,CCRO ! Read CCRO. 

andi/ori RN,RN,OxXXXX___! Execute and/or function to change any CCRO bits. 
! Can use two instructions before having to touch 
! in two cache lines. 

mtspr CCRO, RN ! Update CCRO. 

isync ! Refetch instructions under new processor context. 

b back ! Branch back to initialization code. 


CCRO[DPP1, UOXE] affect DCU operation. When these fields are altered, execution of the following 
code sequence (Sequence 2) is required. Note that Sequence 1 includes Sequence 2, so Sequence 


1 can be used to alter any CCRO fields. 
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In the following sample code, registers RN, RM, RX, and RZ are any available GPRs. 


! SEQUENCE 2 Alter CCRO[DPP1, UOXE) 
! Turn off interrupts 
mfmsr RM 
addis RZ,r0,0x0002 ! CE bit 
ori RZ,RZ,0x8000 ! EE bit 
andc RZ,RM,RZ —! Turn off MSR[CE,EE] 
mtmsr RZ 
! sync 
sync 
! Alter CCRO bits 
mfspr RN,CCRO  ! Read CCRO. 
andi/ori RN,RN,OxXXXX_ ! Execute and/or function to change any CCRO bits. 
mtspr CCRO,RN __ ! Update CCRO. 


isync ! Refetch instructions under new processor context. 
! Restore MSR to original value 
mtmsr RM 


CCRO[CIS, CWS] do not require special programming. 


4.5.2 ICU Debugging 


The icread instruction enables the reading of the instruction cache entries for the congruence class 
specified by EA;g.9g, unless no cache array is present. The cache information is read into the 
ICDBDR; from there it can subsequently be moved, using a mfspr instruction, into a GPR. 


Figure 4-3. Instruction Cache Debug Data Register (ICDBDR) 


0:31 Instruction cache information See icread, page -68. 
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ICU tag information is placed into the ICDBDR as shown: 


0:21 TAG Cache Tag 
22:26 Reserved 
27 V Cache Line Valid 
0 Not valid 
1 Valid 
28:30 Reserved 
31 LRU Least Recently Used (LRU) 
0 A-way LRU 
1 B-way LRU 


If CCRO[CIS] = 0, the data is a word of ICU data from the addressed line, specified by EA97.29. If 
CCRO[CWS] = 0, the data is from the A-way; otherwise; the data from the B-way. 


If CCRO[CIS] = 1, the cache information is the cache tag. If CCRO[CWS] = 0, the tag is from the A- 
way; otherwise, the tag is from the B-way. 


Programming Note: The instruction pipeline does not wait for data from an icread instruction to 
arrive before attempting to use the contents the ICDBDR. The following code sequence ensures 
proper results: 


icread r5,r6# read cache information 
isync # ensure completion of icread 
mficdbdr r7# move information to GPR 


4.5.3. DCU Debugging 


The dcread instruction provides a debugging tool for reading the data cache entries for the 


congruence class specified by EA;g-9g, unless no cache array is present. The cache information is 
read into a GPR. 


If CCRO[CIS] = 0, the data is a word of DCU data from the addressed line, specified by EAo7.99. If 
EA39-31 are not 00, an alignment exception occurs. If CCRO[CWS] = 0, the data is from the A-way; 
otherwise; the data is from the B-way. 


If CCRO[CIS] = 1, the cache information is the cache tag. If CCRO[CWS] = 0, the tag is from the A- 
way; otherwise the tag is from the B-way. 
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DCU tag information is placed into the GPR as shown: 


0:19 TAG | Cache Tag 

20:25 Reserved 

26 D Cache Line Dirty 
0 Not dirty 
1 Dirty 

27 V Cache Line Valid 
0 Not valid 
1 Valid 

28:30 Reserved 

31 LRU | Least Recently Used (LRU) 
0 A-way LRU 
1 B-way LRU 


Note: A “dirty” cache line is one which has been accessed by a store instruction after it was 
established, and can be inconsistent with external memory. 


4.6 DCU Performance 


DCU performance depends upon the application and the design of the attached external bus 
controller, but, in general, cache hits complete in one cycle without stalling the CPU pipeline. Under 
certain conditions and limitations of the DCU, the pipeline stalls (stops executing instructions) until the 
DCU completes current operations. 


Several factors affect DCU performance, including: 


* Pipeline stalls 

¢ DCU priority 

¢ Simultaneous cache operations 
* Sequential cache operations 


4.6.1 Pipeline Stalls 


The CPU issues commands for cache operations to the DCU. If the DCU can immediately perform the 
requested cache operation, no pipeline stall occurs. In some cases, however, the DCU cannot 
immediately perform the requested cache operation, and the pipeline stalls until the DCU can perform 
the pending cache operation. 


In general, the DCU, when hitting in the cache array, can execute a load/store every cycle. If a cache 
miss occurs, the DCU must retrieve the line from main memory. For cache misses, the DCU stores 
the cache line in a line fill buffer until the entire cache line is received. The DCU can accept new DCU 
commands while the fill progresses. If the instruction causing the line fill is a load, the target word is 
bypassed to the GPR during the cycle after it becomes available in the fill buffer. When the fill buffer is 
full, it must be moved into the tag and data arrays. During this time, the DCU cannot begin a new 
cache operation and stalls the pipeline if new DCU commands are presented. Storing a line in the line 
fill buffer takes 3 cycles, unless the line being replaced has been modified. In that case, the operation 
takes 4 cycles. 
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The DCU can accept up to two load commands. If the data for the first load command is not 
immediately available, the DCU can still accept the second load commana. If the load data is not 
required by subsequent instructions, those instructions will continue to execute. If data is required 
from either load command, the CPU pipeline will stall until the load data has been delivered. The 
pipeline will also stall until the second load has read the data array if a subsequent data cache 
command is issued. 


In general, if the fill buffer is being used and the next load or store command requires the fill buffer, 
only one additional command can be accepted before causing additional DCU commands to stall the 
pipeline. 


The DCU can accept up to three outstanding store commands before stalling the CPU pipeline for 
additional data cache commands. 


The DCU can have two flushes pending before stalling the CPU pipeline. 


DCU cache operations other than loads and stores stall the CPU pipeline until all prior data cache 
operations complete. Any subsequent data cache command will stall the pipeline until the prior 
operation is complete. 


4.6.2 Cache Operation Priorities 


The DCU uses a priority signal to improve performance when pipeline stalls occur. When the pipeline 
is stalled because of a data cache operation, the DCU asserts the priority signal to the PLB. The 
priority signal tells the external bus that the DCU requires immediate service, and is valid only when 
the data cache is requesting access to the PLB. The priority signal is asserted for all loads that 
require external data, or when the data cache is requesting the PLB and stalling an operation that is 
being presented to the data cache. 


Table 4-4 provides examples of when the priority is asserted and deasserted. 


Table 4-4. Priority Changes With Different Data Cache Operations 


Instruction 
Requesting PLB Priority Next Instruction Priority 
| Anyloadfromextenal | 1 |NA © | NA | 

memory 

Any store 0 Any other cache operation not being accepted by the DCU. 1 
dcbf 0 Any cache hit. 0 
dcbf/dcbst 0 Load non-cache. 1 
dcbf/dcbst 0 Another command that requires a line flush. i 
dcbt 0 Any cache hit. 0 
dcbi/dccci/dcbz 0 N/A N/A 


4.6.3. Simultaneous Cache Operations 


Some cache operations can occur simultaneously to improve DCU performance. For example, 
combinations of line fills, line flushes, word load/stores, and operations that hit in the cache can occur 
simultaneously. Cache operations other than loads/stores cannot begin until the PLB completes all 
previous operations. 
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4.6.4 Sequential Cache Operations 


Some common cache operations, when performed sequentially, can limit DCU performance: 
sequential loads/stores to non-cachable storage regions, sequential line fills, and sequential line 
flushes. 


In the case of sequential cache hits, the most commonly occurring operations, the DCU loads or 
stores data every cycle. In such cases, the DCU does not limit performance. 


However, when a load from a non-cachable storage region is followed by multiple loads from non- 
cachable regions, the loads can complete no faster than every four cycles, assuming that the 
addresses are accepted during the same cycle in which it is requested, and that the data is returned 
during the cycle after the load is accepted. 


Similarly, when a store to a non-cachable storage region is followed by multiple stores to non- 
cachable regions the fastest that the stores can complete is every other cycle. The DCU can have 
accepted up to three stores before additional DCU commands will stall waiting for the prior stores to 
complete. 


Sequential line fills can limit DCU performance. Line fills occur when a load/store or debt instruction 
misses in the cache, and can be pipelined on the PLB interface such that up to two requests can be 
accepted before stalling subsequent requests. The subsequent operations will wait in the DCU until 
the first line fill completes. The line fills must complete in the order that they are accepted. 


Sequential line flushes from the DCU to main memory also limit DCU performance. Flushes occur 
when a line fill replaces a valid line that is marked dirty (modified), or when a debf instruction flushes 
a specific line. If two flushes are pending, the DCU stalls any new data cache operations until the first 
flush finishes and the second flush begins. 
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Chapter 5. Fixed-Point Interrupts and Exceptions 


An interrupt is the action in which the processor saves its old context (MSR and instruction pointer) 
and begins execution at a pre-determined interrupt-handler address, with a modified MSR. 
Exceptions are events which, if enabled, cause the processor to take an interrupt. Exceptions are 
generated by signals from internal and external peripherals, instructions, internal timer facilities, 
debug events, or error conditions. 


Table 5-2 on page 5-6, lists the interrupts handled by the PPC405 in the order of interrupt vector 
offsets. Detailed descriptions of each interrupt follow, in the same order. Table 5-2 also provides an 
index to the descriptions. 


Several registers support interrupt handling and control. “General Interrupt Handling Registers” on 
page 5-7 describes the general interrupt handling registers: 


« Data Exception Address Register (DEAR) 
« Exception Syndrome Register (ESR) 

¢ Exception Vector Prefix Register (EVPR) 
¢ Machine State Register (MSR) 

* Save/Restore Registers (SRRO-SRR3) 


Two external interrupt input signals are provided in the PPC405. One external interrupt input is for 
critical interrupts; the other in for non-critical interrupts. Both external interrupts are maskable. The 
MSR enables critical and noncritical external interrupt signals. 


5.1. Architectural Definitions and Behavior 


Precise interrupts are those for which the instruction pointer saved by the interrupt must be either the 
address of the excepting instruction or the address of the next sequential instruction. /mprecise 
interrupts are those for which it is possible (but not required) for the saved instruction pointer to be 
something else, possibly prohibiting guaranteed software recovery. 


Note that “precise” and “imprecise” are defined assuming that the interrupts are unmasked (enabled 
to occur) when the associated exception occurs. Consider an exception that would cause a precise 
interrupt, if the interrupt was enabled at the time of the exception, but that occurs while the interrupt is 
masked. Some exceptions of this type can cause the interrupt to occur later, immediately upon its 
enabling. In such a case, the interrupt is not considered precise with respect to the enabling 
instruction, but imprecise (“delayed precise”) with respect to the cause of the exception. 


Asynchronous interrupts are caused by events which are independent of instruction execution. All 
asynchronous interrupts are precise, and the following rules apply: 


1. All instructions prior to the one whose address is reported to the interrupt handling routine (in the 
save/restore register) have completed execution. However, some storage accesses generated by 
these preceding instructions may not have completed. 


2. No subsequent instruction has begun execution, including the instruction whose address is 
reported to the interrupt handling routine. 
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3. The instruction having its address reported to the interrupt handler may appear not to have begun 
execution, or may have partially completed. 


Synchronous interrupts are caused directly by the execution (or attempted execution) of instructions. 
Synchronous interrupts can be either precise or imprecise. 


For synchronous precise interrupts, the following rules apply: 


1. The save/restore register addresses either the instruction causing the exception or the next 
sequential instruction. Which instruction is addressed is determined by the interrupt type and 
status bits. 


2. All instructions preceding the instruction causing the exception have completed execution. 
However, some storage accesses generated by these preceding instructions may not have 
completed. 


3. The instruction causing the exception may appear not to have begun execution (except for causing 
the exception), may have partially completed, or may have completed, depending on the interrupt 


type. 
4. No subsequent instruction has begun execution. 


Refer to IBM PowerPC Embedded Environment for an architectural description of imprecise 
interrupts. 


Machine check interrupts are a special case typically caused by some kind of hardware or storage 
subsystem failure, or by an attempt to access an invalid address. A machine check can be indirectly 
caused by the execution of an instruction, but not recognized or reported until long after the processor 
has executed past the instruction that caused the machine check. As such, machine check interrupts 
cannot properly be thought of as synchronous, nor as precise or imprecise. For machine checks, the 
following general rules apply: 


1. No instruction following the one whose address is reported to the machine check handler in the 
save/restore register has begun execution. 


2. The instruction whose address is reported to the machine check handler in the save/restore 
register, and all previous instructions, may or may not have completed successfully. All previous 
instructions that would ever complete have completed, within the context existing before the 
machine check interrupt. No further interrupt (other than possible additional machine checks) can 
occur as a result of those instructions. 


5.2 Behavior of the PPC405 Processor Core Implementation 


All interrupts, except for machine checks, are handled precisely. Precise handling implies that the 
address of the excepting instruction (for synchronous exceptions other than the system call 
exception), or the address of the next instruction to be executed (asynchronous exceptions and the 
system call exception), is passed to an interrupt handling routine. Precise handling also implies that 
all instructions that precede the instruction whose address is reported to the interrupt handling routine 
have executed and that no subsequent instruction has begun execution. The specific instruction 
whose address is reported may not have begun execution or may have partially completed, as 
specified for each precise interrupt type. 
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Synchronous precise interrupts include most debug event interrupts, program interrupts, instruction 
and data storage interrupts,auxiliary processor unit (APU) interrupts, floating point unit (FPU 
interrupts, TLB miss interrupts, system call interrupts, and alignment interrupts. 


Asynchronous precise interrupts include the critical and noncritical external interrupts, timer facility 
interrupts, and some debug events. 


In the PPC405, machine checks are handled as critical interrupts (see “Critical and Noncritical 
Interrupts” on page 5-5). If a machine check is associated with an instruction fetch, the critical 
interrupt save/restore register contains the address of the instruction being fetched when the machine 
check occurred. 


The synchronism of instruction-side machine checks (errors that occur while attempting to fetch an 
instruction from external memory) requires further explanation. Fetch requests to cachable memory 
that miss in the instruction cache unit (ICU) cause an instruction cache line fill (eight words). If any 
instructions (words) in the fetched line are associated with an exception, an interrupt occurs upon 
attempted execution and the cache line is invalidated. 


It is improper to declare an exception when an erroneous word is passed to the fetcher; the address 
could be the result of an incorrect speculative access. It is quite likely that no attempt will be made to 
execute an instruction from the erroneous address. An instruction-side machine check interrupt 
occurs only when execution is attempted. If an exception occurs, execution is suppressed, SRR2 
contains the erroneous address, and the ESR indicates that an instruction-side machine check 
occurred. Although such an interrupt is clearly asynchronous to the erroneous memory access, it is 
handled synchronously with respect to the attempted execution from the erroneous address. 


Except for machine checks, all PPC405 interrupts are handled precisely: 


¢ The address of the excepting instruction (for synchronous exceptions, other than the system call 
exception) or the address of the next sequential instruction (for asynchronous exceptions and the 
system call exception) is passed to the interrupt handling routine. 


¢ All instructions that precede the instruction whose address is reported to the interrupt handling 
routine have completed execution and that no subsequent instruction has begun execution. The 
specific instruction whose address is reported might not have begun execution or might have 
partially completed, as specified for each interrupt type. 


5.3 Interrupt Handling Priorities 


The PPC405 core only one interrupt at a time. Multiple simultaneous interrupts are handled in the 
priority order shown in Table 5-1 (assuming, of course, that the interrupt types are enabled). 


Multiple interrupts can exist simultaneously, each of which requires the generation of an interrupt. The 
architecture does not provide for simultaneously reporting more than one interrupt of the same class 
(critical or non-critical). Therefore, interrupts are ordered with respect to each other. A masking 
mechanism is available for certain persistent interrupt types. 


When an interrupt type is masked, and an event causes an exception which would normally generate 
an interrupt of that type, the exception persists as a status bit in a register. However, no interrupt is 
generated. Later, if the interrupt type is enabled (unmasked), and the exception status has not been 
cleared by software, the interrupt due to the original exception event is finally generated. 


Fixed-Point Interrupts and Exceptions 5-3 


All asynchronous interrupt types can be masked. In addition, certain synchronous interrupt types can 
be masked. 


Table 5-1. Interrupt Handling Priorities 


Critical or 
Priority Interrupt Type Noncritical Causing Conditions 

1 Machine check—data Critical External bus error during data-side access 

2 Debug—IAC Critical IAC debug event (in internal debug mode) 

3 Machine check— Critical Attempted execution of instruction for which an external 

instruction bus error occurred during fetch 
Debug—EXC, UDE Critical EXC or UDE debug event (in internal debug mode) 

5 Critical interrupt input Critical Active level on the critical interrupt input 

6 Watchdog timer—first Critical Posting of an enabled first time-out of the watchdog 

time-out timer in the TSR 

7 Instruction TLB Miss Noncritical | Attempted execution of an instruction at an address 
and process ID for which a valid matching entry was not 
found in the TLB 

8 Instruction storage — Noncritical | Instruction translation is active, execution access to the 

ZPR[Zn] = 00 translated address is not permitted because 
ZPR[Zn] = 00 in user mode, and an attempt is made to 
execute the instruction 

9 Instruction storage — Noncritical | Instruction translation is active, execution access to the 

TLB_entry[EX] = 0 translated address is not permitted because 
TLB_entry[EX] = 0, and an attempt is made to execute 
the instruction 

Instruction storage — Noncritical | Instruction translation is active, the page is marked 

TLB_entry[G] = 1 or guarded, and an attempt is made to execute the 

SGR[Gn] = 1 instruction 

Program Noncritical | Attempted execution of illegal instructions, TRAP 
instruction, privileged instruction in problem state, or 
auxiliary processor (APU) instruction, or 
unimplemented FPU instruction, or unimplemented 
APU instruction, or APU interrupt, or FPU interrupt 

System call Noncritical | Execution of the sc instruction 

APU Unavailable Noncritical | Attempted execution of an APU instruction when 
MSRI[AP] = 0 

FPU Unavailable Noncritical | Attempted execution of an FPU instruction when 
MSR[FP]=0. 

11 Data TLB miss Noncritical | Valid matching entry for the effective address and 
process ID of an attempted data access is not found in 
the TLB 

12 Data storage— Noncritical | Data translation is active and data-side access to the 

ZPR[Zn] = 00 translated address is not permitted because 
ZPR[Zn] = 00 in user mode 
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Table 5-1. Interrupt Handling Priorities (continued) 


Critical or 
Priority Interrupt Type Noncritical Causing Conditions 
13 Data storage— Noncritical | Data translation is active and write access to the 
TLB_entry[WR] = 0 translated address is not permitted because 
TLB_entry[WR] = 0 
Data storage— Noncritical | Data translation is active and write access to the 
TLB_entry[U0] = 1 or translated address is not permitted because 
SUOR[Un] = 1 TLB_entry[U0] = 1 or SUOR[Un] = 1 
14 Alignment Noncritical | dcbz to non-cachable address or write-through 
storage; non-word aligned dcread, lwarx, and stwex, 
as described in Table 5-10; misaligned APU or FPU 
data access 
15 Debug—BT, DAC, DVC, Critical BT, DAC, DVC, IC, TIE debug event (in internal debug 
IC, TIE mode) 
16 External interrupt input Noncritical | Interrupts from the external interrupt input 
17 Fixed Interval Timer (FIT) Noncritical | Posting of an enabled FIT interrupt in the TSR 
18 Programmable Interval Noncritical | Posting of an enabled PIT interrupt in the TSR 
Timer (PIT) 


5.4 Critical and Noncritical Interrupts 


The PPC405 processes interrupts as noncritical and critical. The following interrupts are defined as 
noncritical: data storage, instruction storage, an active external interrupt input, alignment, program, 
FPU unavailable, APU unavailable, system call, programmable interval timer (PIT), fixed interval timer 
(FIT), data TLB miss, and instruction TLB miss. The following interrupts are defined as critical: 
machine check interrupts (instruction- and data-side), debug interrupts, interrupts caused by an active 
critical interrupt input, and the first time-out from the watchdog timer. 


When a noncritical interrupt is taken, Save/Restore Register 0 (SRRO) is written with the address of 
the excepting instruction (most synchronous interrupts) or the next sequential instruction to be 
processed (asynchronous interrupts and system call). 


If the PPC405 was executing a multicycle instruction (multiply, divide, or cache operation), the 
instruction is terminated and its address is written in SRRO. 


Aligned scalar loads/stores that are interrupted do not appear on the PLB. An aligned scalar 
load/store cannot be interrupted after it is requested on the PLB, so the Guarded (G) storage attribute 
does not need to prevent the interruption of an aligned scalar load/store. 


To enhance performance, the DCU can respond to non-cachable load requests by retrieving a line 
instead of a word. This is controlled by CCRO[LWL]. Note, however, that If CCRO[LWL] = 1, and the 
target non-cachable region is also marked as guarded (the G storage attribute is set to 1), that the 
DCU will request on the PLB only those bytes requested by the CPU. 


Load/store multiples, load/store string, and misaligned scalar loads/stores that cross a word boundary 
can be interrupted and restarted upon return from the interrupt handler. 


When load instructions terminate, the addressing registers are not updated. This ensures that the 
instructions can be restarted; if the addressing registers were in the range of registers to be loaded, 
this would be an invalid form in any event. Some target registers of a load instruction may have been 
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written by the time of the interrupt; when the instruction restarts, the registers will simply be written 
again. Similarly, some of the target memory of a store instruction may have been written, and is 
written again when the instruction restarts. 


Save/Restore Register 1 (SRR1) is written with the contents of the MSR; the MSR is then updated to 
reflect the new machine context. The new MSR contents take effect beginning with the first instruction 
of the interrupt handling routine. 


Interrupt handling routine instructions are fetched at an address determined by the interrupt type. The 
address of the interrupt handling routine is formed by concatenating the 16 high-order bits of the 
EVPR and the interrupt vector offset. (A user must initialize the EVPR contents at power-up using an 
mtspr instruction.) 


Table 5-2 shows the interrupt vector offsets for the interrupt types. Note that there can be multiple 
sources of the same interrupt type; interrupts of the same type are mapped to the same interrupt 
vector, regardless of source. In such cases, the interrupt handling routine must examine status 
registers to determine the exact source of the interrupt. 


At the end of the interrupt handling routine, execution of an rfi instruction forces the contents of SRRO 
and SRR1 to be written to the program counter and the MSR, respectively. Execution then begins at 
the address in the program counter. 


Critical interrupts are processed similarly. When a critical interrupt is taken, Save/Restore 

Register 2 (SRR2) and Save/Restore Register 3 (SRR3) hold the next sequential address to be 
processed when returning from the interrupt, and the contents of the MSR, respectively. At the end of 
the critical interrupt handling routine, execution of an rfci instruction writes the contents of SRR2 and 
SRR3 into the program counter and the MSR, respectively. 


Table 5-2. Interrupt Vector Offsets 


Offset Interrupt Type Interrupt Class Category | Page 
0x0100 | Critical input interrupt Asynchronous precise | Critical 5-13 
0x0200 | Machine check—data — Critical 5-14 
Machine check—instruction — Critical 5-14 
0x0300 | Data storage interrupt— Synchronous precise Noncritical 5-16 
MSR[DR]=1 and 
ZPR[Zn] = 0 or 


TLB_entry[WR] = 0 or 
TLB_entry[U0] = 1 or 


SUOR[UN] = 1 

0x0400 | Instruction storage interrupt | Synchronous precise Noncritical 5-17 
0x0500 | External interrupt Asynchronous precise | Noncritical 5-18 
0x0600 | Alignment Synchronous precise Noncritical 5-19 
0x0700 | Program Synchronous precise Noncritical 5-20 
0x0800 | FPU Unavailable Synchronous precise Noncritical | 5-21 

0x0C00 | System Call Synchronous precise Noncritical 5-22 
Ox0F20 | APU Unavailable Synchronous precise Noncritical | 5-22 

0x1000 | PIT Asynchronous precise | Noncritical 5-22 
0x1010 | FIT Asynchronous precise | Noncritical 5-23 
0x1020 | Watchdog timer Asynchronous precise | Critical 5-24 
0x1100 | Data TLB miss Synchronous precise Noncritical 5-25 
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Table 5-2. Interrupt Vector Offsets (continued) 


Offset Interrupt Type Interrupt Class Category | Page 
| 0x1200 | Instruction TLB miss | Synchronous precise | Noncritical | 5-25 | 
0x2000 | Debug—BT, DAC, DVC, Synchronous precise Critical 5-26 

IAC, IC, TIE 
Debug—EXC, UDE Asynchronous precise | Critical 


5.5 General Interrupt Handling Registers 


The general interrupt handling registers are the Machine State Register (MSR), SRRO—-SRR3, the 
Exception Vector Prefix Register (EVPR), the Exception Syndrome Register (ESR), and the Data 
Exception Address Register (DEAR). 


5.5.1. Machine State Register (MSR) 


The MSR is a 32-bit register that holds the current context of the PPC405. When a noncritical 
interrupt is taken, the MSR contents are written to SRR1; when a critical interrupt is taken, the MSR 
contents are written to SRR3. When an rfi or rfci instruction executes, the contents of the MSR are 
read from SRR1 or SRR3, respectively. 


Programming Note: The rfi and rfci instructions can alter reserved MSR fields. 


The MSR contents can be read into a general purpose register (GPRs) using an mfmstr instruction. 
The contents of a GPR can be written to the MSR using an mtmsr instruction. The MSR[EE] bit may 
be set/cleared atomically using the wrtee or wrteei instructions. 


Figure 5-1 shows the MSR bit definitions and describes the function of each bit. 


APE CE PR ME DWE FE1 DR 
0 5/617 11/12)13}14)15/ 16) 17/18/19 }20)21 |22)23)24 25/26/27 |28 31 
AP WE EE FP FEO DE f 
Figure 5-1. Machine State Register (MSR) 
0:5 Reserved 
6 AP Auxiliary Processor Available 
0 APU not available. 
1 APU available. 
7:11 Reserved 
12 APE APU Exception Enable 
0 APU exception disabled. 
1 APU exception enabled. 
13 WE Wait State Enable If MSR[WE] = 1, the processor remains in 
0 The processor is not in the wait state. the wait state until an interrupt is taken, a 
1 The processor is in the wait state. reset occurs, or an external debug tool 
clears WE. 
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CE 


Critical Interrupt Enable 
0 Critical interrupts are disabled. 
1 Critical interrupts are enabled. 


Controls the critical interrupt input and 
watchdog timer first time-out interrupts. 


15 


Reserved 


16 


EE 


External Interrupt Enable 
0 Asynchronous interruptsare disabled. 
1 Asynchronous interrupts are enabled. 


Controls the non-critical external interrupt 
input, PIT, and FIT interrupts. 


PR 


Problem State 

O Supervisor state (all instructions 
allowed). 

1 Problem state (some instructions not 
allowed). 


FP 


Floating Point Available 

0 The processor cannot execute floating- 
point instructions 

1 The processor can execute floating-point 
instructions 


ME 


Machine Check Enable 
0 Machine check interrupts are disabled. 
1 Machine check interrupts are enabled. 


20 


FEO 


Floating-point exception mode 0 

0 If MSR[FE1] = 0, ignore exceptions 
mode; if MSR[FE1] = 1, imprecise 
nonrecoverable mode 

1 If MSR[FE1] = 0, imprecise recoverable 
mode; if MSR[FE1] = 1, precise mode 


21 


DWE 


Debug Wait Enable 
0 Debug wait mode is disabled. 
1 Debug wait mode is enabled. 


22 


DE 


Debug Interrupts Enable 
0 Debug interrupts are disabled. 
1 Debug interrupts are enabled. 


23 


FE1 


Floating-point exception mode 1 

0 If MSR[FEO] = 0, ignore exceptions 
mode; if MSR[FEO] = 1, imprecise 
recoverable mode 

1 If MSR[FEO] = 0, imprecise non- 
recoverable mode; if MSR[FEO] = 1, 
precise mode 


24:25 


Reserved 


26 


Instruction Relocate 

0 Instruction address translation is 
disabled. 

1 Instruction address translation is 
enabled. 


27 


DR 


Data Relocate 
0 Data address translation is disabled. 
1 Data address translation is enabled. 
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28:31 Reserved 


5.5.2 Save/Restore Registers 0 and 1 (SRRO-SRR1) 


SRRO and SRR1 are 32-bit registers that hold the interrupted machine context when a noncritical 
interrupt is processed. On interrupt, SRRO is set to the current or next instruction address and the 
contents of the MSR are written to SRR1. When an rfi instruction is executed at the end of the 
interrupt handler, the program counter and the MSR are restored from SRRO and SRR1, respectively. 


The contents of SRRO and SRRi1 can be written into GPRs using the mfspr instruction. The contents 
of GPRs can be written to SRRO and SRR1 using the mtspr instruction. 


Figure 5-2 shows the bit definitions for SRRO. 


0 29/30 31 


Figure 5-2. Save/Restore Register 0 (SRRO) 


0:29 SRRO receives an instruction address when a non-critical interrupt is taken; 
the Program Counter is restored from SRRO when rfi executes. 
30:31 Reserved 


Figure 5-3 shows the bit definitions for SRR1. 


APE CE PR ME DWE FE1 DR 
+4 ne ee ee t 
0 5/6/7 11/12)13}14)15)16)17/18)19}20)21 }22)23 24 25)26)/27|28 31 
t il t 
AP WE EE FP FEO DE | 


Figure 5-3. Save/Restore Register 1 (SRR1) 


0:31 SRR1 receives a copy of the MSR when an 
interrupt is taken; the MSR is restored from 
SRR1 when rfi executes. 


5.5.3 Save/Restore Registers 2 and 3 (SRR2-SRR3) 


SRR2 and SRR3 are 32-bit registers that hold the interrupted machine context when a critical 
interrupt is processed. On interrupt, SRR2 is set to the current or next instruction address and the 
contents of the MSR are written to SRR3. When an rfci instruction is executed at the end of the 
interrupt handler, the program counter and the MSR are restored from SRR2 and SRR3, respectively. 
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The contents of SRR2 and SRR3 can be written to GPRs using the mfspr instruction. The contents of 
GPRs can be written to SRR2 and SRR3 using the mtspr instruction. 


Figure 5-4 shows the bit definitions for SRR2. 


0 29/30 31 


Figure 5-4. Save/Restore Register 2 (SRR2) 


0:29 SRR2 receives an instruction address when a critical interrupt is taken; the Program 
Counter is restored from SRR2 when rfci executes. 
30:31 Reserved 


Figure 5-5 shows the bit definitions for SRR3. 


APE CE PR ME DWE FE1 DR 
+ + oy ¥ 4 ¢ 
0 5/6/7 11/12)13)14)15)16)17/18)19}20)21 }22)23 24 25)26)/27|28 31 
i t ae: t 
AP WE EE FP FEO DE | 


Figure 5-5. Save/Restore Register 3 (SRR3) 


0:31 SRR3 receives a copy of the MSR when a 
critical interrupt is taken; the MSR is 
restored from SRR3 when rfci executes. 


Because Critical interrupts do not automatically clear MSR[ME], SRR2 and SRR can be corrupted by 
a machine check interrupt, if the machine check occurs while SRR2 and SRR3 contain valid data that 
has not yet been saved by the critical interrupt handler. 


5.5.4 Exception Vector Prefix Register (EVPR) 


The EVPR is a 32-bit register whose high-order 16 bits contain the prefix for the address of an 
interrupt handling routine. The 16-bit interrupt vector offsets (shown in Table 5-2 on page 5-6) are 
concatenated to the right of the high-order 16 bits of the EVPR to form the 32-bit address of an 
interrupt handling routine. 


The contents of the EVPR can be written to a GPR using the mfspr instruction. The contents of a 
GPR can be written to EVPR using the mtspr instruction. 


Figure 5-6 shows the EVPR bit definitions. 
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EVP 


Figure 5-6. Exception Vector Prefix Register (EVPR) 


0:15 EVP | Exception Vector Prefix 
16:31 Reserved 


5.5.5 Exception Syndrome Register (ESR) 


The ESR is a 32-bit register whose bits help to specify the exact cause of various synchronous 
interrupts. These interrupts include instruction side machine checks, data storage interrupts, and 
program interrupts, instruction storage interrupts, and data TLB miss interrupts. 


“Instruction Machine Check Handling” on page 5-14 describes instruction machine checks. “Data 
Storage Interrupt” on page 5-16 describes data storage interrupts. “Program Interrupt” on page 5-20 
describes program interrupts. 


Although interrupt handling routines are not required to reset the ESR, it is recommended that 
instruction machine check handlers reset the ESR; “Instruction Machine Check Handling” on 
page 5-14 describes why such resets are recommended. 


The contents of the ESR can be written to a GPR using the mfspr instruction. The contents of a GPR 
can be written to the ESR using the mtspr instruction. 


Figure 5-7 shows the ESR bit definitions. 


MCI PIL PTR DST PFP UOF 
t { yy + t 
0 4 16 


6} 7) 8 |9 410 11/12/13) 14)15 


7 31 


Uo 
> 


Figure 5-7. Exception Syndrome Register (ESR) 


0 MCI Machine check—instruction 
0 Instruction machine check did not occur. 
1 Instruction machine check occurred. 


1:3 Reserved 


4 PIL Program interrupt—illegal 
0 Illegal Instruction error did not occur. 
1 Illegal Instruction error occurred. 


5 PPR Program interrupt—privileged 
0 Privileged instruction error did not occur. 
1 Privileged instruction error occurred. 
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6 PTR Program interrupt—trap 

0 Trap with successful compare did not 
occur. 

1 Trap with successful compare occurred. 


7 PEU Program interrupt—Unimplemented 

0 APU/FPU unimplemented exception did 
not occur. 

1 APU/FPU unimplemented exception 
occurred. 


8 DST Data storage interrupt—store fault 

0 Excepting instruction was not a store. 

1 Excepting instruction was a store 
(includes debi, dcbz, and dccci). 


9 DIZ Data/instruction storage interrupt—zone 
fault 

0 Excepting condition was not a zone fault. 
1 Excepting condition was a zone fault. 


10:11 Reserved 


12 PFP Program interrupt—FPU 
O FPU interrupt did not occur. 
1 FPU interrupt occurred. 


13 PAP Program interrupt—APU 
0 APU interrupt did not occur. 
1 APU interrupt occurred. 


14:15 Reserved 


16 UOF Data storage interrupt—UO fault 

0 Excepting instruction did not cause a U0 
fault. 

1 Excepting instruction did cause a U0 
fault. 


17:31 Reserved 


In general, ESR bits are set to indicate the type of precise interrupt that occurred; other bits are 
cleared. However, the machine check—instruction (ESR[MCI]) bit behaves differently. Because 
instruction-side machine checks can occur without an interrupt being taken (if MSR[ME] = 0), 
ESR[MCl] can be set even while other ESR-setting interrupts (program, data storage, DTLB-miss) 
occurring. Thus, data storage and program interrupts leave ESR[MCI] unchanged, clear all other ESR 
bits, and set the bits associated with any data storage or program interrupts that occurred. Enabled 
instruction-side machine checks (MSR[ME] = 1) set ESR[MCI] and clear the data storage and 
program interrupt bits. 


If a machine check—instruction interrupt occurs but is disabled (MSR[ME] = 0), it sets ESR[MCI] but 
leaves the data storage and program interrupt bits alone. If a machine check—instruction interrupt 

occurs while MSR[ME] = 0, and the instruction upon which the machine check—instruction interrupt 
is occurring also is some other kind of ESR-setting instruction (program, data storage, DTLB-miss, or 
instruction storage interrupt), ESR[MCI] is set to indicate that a machine check—instruction interrupt 
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occurred; the other ESR bits are set or cleared to indicate the other interrupt. These scenarios are 


summarized in Table 5-3 


Table 5-3. ESR Alteration by Various Interrupts 


Scenario ECR[MCI] | ESR4.7 1213 ESR¢-9, 16 
Program interrupt Unchanged | Set to type Cleared 
Data storage interrupt Unchanged | Cleared Set to Type 
Data TLB miss interrupt Unchanged | Cleared Cleared 
Machine check—instruction Set to 1 Cleared Cleared 
Disabled MCI, no others Unchanged | Unchanged __| Unchanged 
Disabled MCI and program interrupt Unchanged | Set to type Cleared 


Engineering Note: An implementation can use additional ESR bits to identify implementation- 
specific exception types. Implementations can also use the ESR to record information about the 
cause of a machine check interrupt. 


5.5.6 Data Exception Address Register (DEAR) 


The DEAR is a 32-bit register that contains the address of the access for which one of the following 
synchronous precise errors occurred: alignment error, data TLB miss, or data storage interrupt. 


The contents of the DEAR can be written to a GPR using the mfspr instruction. The contents of a 
GPR can be written to the DEAR using the mtspr instruction. 


Figure 5-8 shows the DEAR bit definitions. 


0 31 


Figure 5-8. Data Exception Address Register (DEAR) 


0:31 Address of Data Error (synchronous) 


5.6 Critical Input Interrupts 


An external source requests a critical interrupt by driving the critical interrupt input active. The critical 
interrupt is recognized if enabled by MSR[CE]. 


MSR[CE] also enables the watchdog timer first-time-out interrupt. However, the watchdog interrupt 
has a different interrupt vector than the critical pin interrupt. See “Watchdog Timer Interrupt” on 
page 5-24. 


After detecting a critical interrupt, if no synchronous precise interrupts are outstanding, the PPC405 
immediately takes the critical interrupt and writes the address of the next instruction to be executed in 
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SRR2. Simultaneously, the contents of the MSR are saved in SRR3. MSR[CE] is reset to 0 to prevent 
another critical interrupt or the watchdog timer first time-out interrupt from interrupting the critical 
interrupt handler before SRR2 and SRR3 get saved. MSR[DE] is reset to 0 to disable debug interrupts 
during the critical interrupt handler. 


The MSR is also written with the values shown in Table 5-4 on page 5-14. The high-order 16 bits of 
the program counter are then loaded with the contents of the EVPR and the low-order 16 bits of the 
program counter are loaded with 0x0100. Interrupt processing begins at the address in the program 
counter. 


Inside the interrupt handling routine, after the contents of SRR2/SRR3° are saved, critical interrupts 
can be enabled again by setting MSR[CE] = 1. 


Executing an rfci instruction restores the program counter from SRR2 and the MSR from SRR3, and 
execution resumes at the address in the program counter. 


Table 5-4. Register Settings during Critical Input Interrupts 


SRR2 Written with the address of the next instruction to be executed 

SRR3 Written with the contents of the MSR 

MSR AP, APE, WE, CE, EE, PR, FP, FEO, DWE, DE, FE1, IR, DR<-0 
ME« unchanged 

PC EVPRJ[0:15] || 0x0100 


5.7 Machine Check Interrupts 


When an external bus error occurs on an instruction fetch, and execution of that instruction is 
subsequently attempted, a machine check—instruction interrupt occurs. 


When an external bus error occurs while attempting data accesses, a machine check—data interrupt 
occurs. 


When an instruction-side machine check interrupt occurs, the PPC405 stores the address of the 
excepting instruction in SRR2. When a data-side machine check occurs, the PPC405 stores the 
address of the next sequential instruction in SRR2. Simultaneously, for all machine check interrupts, 
the contents of the MSR are loaded into SRR3. 


The MSR Machine Check Enable bit (MSR[ME]}) is reset to 0 to disable another machine check from 
interrupting the machine check interrupt handling routine. The other MSR bits are loaded with the 
values shown in Table 5-5 on page 5-15 and Table 5-6 on page 5-15. The high-order 16 bits of the 
program counter are then written with the contents of the EVPR and the low-order 16 bits of the 
program counter are written with 0x0200. Interrupt processing begins at the new address in the 
program counter. 


Executing an rfci instruction restores the program counter from SRR2 and the MSR from SRR3, and 
execution resumes at the address in the program counter. 
5.7.1. Instruction Machine Check Handling 


When a machine check occurs on an instruction fetch, and execution of that instruction is 
subsequently attempted, a machine check—instruction interrupt occurs. If enabled by MSR[ME], the 
processor reports the machine check—instruction interrupt by vectoring to the machine check 
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handler (EVPR[0:15] || Ox0200), setting ESR[MCI]. Note that only a bus error can cause a machine 
check—instruction interrupt. Taking the vector automatically clears MSR[ME] and the other MSR 
fields. 


Note that it is improper to declare a machine check—instruction interrupt when the instruction is 
fetched, because the address is possibly the result of an incorrect speculation by the fetcher. It is 
quite likely that no attempt will be made to execute an instruction from the erroneous address. The 
interrupt will occur only if execution of the instruction is subsequently attempted. 


When a machine check occurs on an instruction fetch, the erroneous instruction is never validated in 
the instruction cache unit (ICU). Fetch requests to cachable memory that miss in the ICU cause an 
instruction cache line fill (eight words). If any words in the fetched line are associated with an error, an 
interrupt occurs upon attempted execution and the cache line is invalidated. If any word in the line is 
in error, the cache line is invalidated after the line fill. 


ESR[MCIl] is set, even if MSR[ME] = 0. This means that if a machine check—instruction interrupt 
occurs while running in code in which MSR[ME] is disabled, the machine check—instruction interrupt 
is recorded in the ESR, but no interrupt occurs. Software running with MSR[ME] disabled can sample 
ESR[MCI] to determine whether at least one machine check—instruction interrupt occurred during 
the disabled execution. 


If anew machine check—instruction interrupt occurs after MSR[ME] is enabled again, the new 
machine check—instruction interrupt is recorded in ESR[MCI] and the machine check—instruction 
interrupt handler is invoked. However, enabling MSR[ME] again does not cause a machine Check 
interrupt to occur simply due to the presence of ESR[MCI] indicating that a machine check— 
instruction interrupt occurred while MSR[ME] was disabled. The machine check—instruction interrupt 
must occur while MSR[ME] is enabled for the machine check interrupt to be taken. Software should, 
in general, clear the ESR bits before returning from a machine check interrupt to avoid any ambiguity 
when handling subsequent machine check interrupts. 


Table 5-5. Register Settings during Machine Check—Instruction Interrupts 


SRR2 Written with the address that caused the machine check. 
SRR3 Written with the contents of the MSR 
MSR WE, CE, EE, PR, ME, FP, FEO, DWE, DE, FE1, IR, DR<-0 
PC EVPRI[0:15] || 0x0200 
ESR MCI < 1 

All other bits are cleared. 


5.7.2. Data Machine Check Handling 


When a machine check occurs on an data access, a machine check—data interrupt occurs. The 
handling of machine check—data interrupts is implementation-specific. 


Table 5-6. Register Settings during Machine Check—Data Interrupts 


SRR2 Written with the address of the next sequential instruction. 
SRR3 Written with the contents of the MSR 

MSR WE, CE, EE, PR, ME, FP, FEO, DWE, DE, FE1, IR, DR<-0 
PC EVPR[0:15] || 0x0200 
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5.8 Data Storage Interrupt 


The data storage interrupt occurs when the desired access to the effective address is not permitted 
for any of the following reasons: 


¢ A UO fault: any store to an EA with the UO storage attribute set and CCRO[UOXE] = 1 
¢ Inthe problem state with data translation enabled: 


— A zone fault, which is any user-mode storage access (data load, store, icbi, dcbz, dcbst, or 
dcbf) with an effective address with (ZPR field) = 00. (dcbt and debtst will no-op in this 
situation, rather than cause an interrupt. The instructions dcbi, dccci, icbt, and iccci, being 
privileged, cannot cause zone fault data storage interrupts.) 


— Data store or dcbz to an effective address with the WR bit clear and (ZPR field) # 11. (The 
privileged instructions dcbi and dccci are treated as “stores,” but will cause privileged program 
interrupts, rather than data storage interrupts.) 


¢ Inthe supervisor state with data translation enabled: 


— Data store, dcbi, dcbz, or dccci to an effective address with the WR bit clear and (ZPR field) 
other than 11 or 10. 


Programming Note: The icbi, icbt, and iccci instructions are treated as loads from the 
addressed byte with respect to address translation and protection. Instruction cache operations 
use MSR[DR], not MSR[IR], to determine translation of their operands. Instruction storage 
interrupts and Instruction-side TLB Miss Interrupts are associated with the fetching of instructions, 
not with the execution of instructions. Data storage interrupts and data TLB miss interrupts are 
associated with the execution of instruction cache operations. 


When a data storage interrupt is detected, the PPC405 suppresses the instruction causing the 
interrupt and writes the instruction address in SRRO. The Data Exception Address Register (DEAR) is 
loaded with the data address that caused the access violation. ESR bits are loaded as shown in 
Table 5-7 on page 5-17 to provide further information about the error. The current contents of the 
MSR are loaded into SRR1, and MSR bits are then loaded with the values shown in Table 5-7. 


The high-order 16 bits of the program counter are then loaded with the contents of the EVPR and the 
low-order 16 bits of the program counter are loaded with 0x0300. Interrupt processing begins at the 

new address in the program counter. Executing the return from interrupt instruction (rfi) restores the 
contents of the program counter and the MSR from SRRO and SRR1, respectively, and the PPC405 
resumes execution at the new program counter address. 
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For instructions that can simultaneously generate program interrupts (privileged instructions executed 
in Problem State) and data storage interrupts, the program interrupt has priority. 


Table 5-7. Register Settings during Data Storage Interrupts 


SRRO 


Written with the EA of the instruction causing the data storage interrupt 


SRR1 


Written with the value of the MSR at the time of the interrupt 


MSR 


AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR<-0 
CE, ME, DE < unchanged 


PC 


EVPR[0:15] || 0x0300 


DEAR 


Written with the EA of the failed access 


ESR 


DST <1 if excepting operation is a store 

DIZ <1 if access failure caused by a zone protection fault (ZPR[Zn] = 00 in 
user mode) 

UOF <1 if access failure caused by a UO fault (the U0 storage attribute is 
set and CCRO[UOXE] = 1) 

MCI < unchanged 

All other bits are cleared. 


5.9 Instruction Storage Interrupt 


The instruction storage interrupt is generated when instruction translation is active and execution is 
attempted for an instruction whose fetch access to the effective address is not permitted for any of the 


following reasons: 


¢ In Problem State: 


¢ In Supervisor State: 


10. 


Instruction fetch from an effective address with (ZPR field) = 00. 
Instruction fetch from an effective address with the EX bit clear and (ZPR field) # 11. 
Instruction fetch from an effective address contained within a Guarded region (G=1). 


Instruction fetch from an effective address contained within a Guarded region (G=1). 


SRR0O will save the address of the instruction causing the instruction storage interrupt. 


ESR is set to indicate the following conditions: 


Instruction fetch from an effective address with the EX bit clear and (ZPR field) other than 11 or 


¢ If ESR[DIZ] = 1, the excepting condition was a zone fault: the attempted execution of an instruction 
address fetched in user-mode with (ZPR field) = 00. 


¢ If ESR[DIZ] = 0, then the excepting condition was either EX = 0 or G= 1. 


The interrupt is precise with respect to the attempted execution of the instruction. Program flow 


vectors to EVPR[0:15] || 0x0400. 
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The following registers are modified to the specified values: 


Table 5-8. Register Settings during Instruction Storage Interrupts 


SRRO Set to the EA of the instruction for which execute access was not permitted 
SRR1 Set to the value of the MSR at the time of the interrupt 
MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 
PC EVPR[0:15] || 0x0400 
ESR DIZ < 1If access failure due to a zone protection fault (ZPR[Zn] = 00 in 
user mode) 


Note: If ESR[DIZ] is not set, the interrupt occurred because TBL_entry[EX] 
was clear in an otherwise accessible zone, or because of an instruction 
fetch from a storage region marked as guarded. See “Exception Syndrome 
Register (ESR)” on page 5-11 for details of ESR operation. 

MCI <— unchanged 

All other bits are cleared. 


5.10 External Interrupt 


External interrupts are triggered by active levels on the external interrupt inputs. All external 
interrupting events are presented to the processor as a single external interrupt. External interrupts 
are enabled or disabled by MSR[EE]. 


Programming Note: MSR[EE] also enables PIT and FIT interrupts. However, after timer 
interrupts, control passes to different interrupt vectors than for the interrupts discussed in the 
preceding paragraph. Therefore, these timer interrupts are described in “Programmable Interval 
Timer (PIT) Interrupt” on page 5-22 and “Fixed Interval Timer (FIT) Interrupt” on page 5-23. 


5.10.1 External Interrupt Handling 


When MSRIEE] = 1 (external interrupts are enabled), a noncritical external interrupt occurs, and this 
interrupt is the highest priority interrupt condition, the processor immediately writes the address of the 
next sequential instruction into SRRO. Simultaneously, the contents of the MSR are saved in SRR1. 


When the processor takes a noncritical external interrupt, MSR[EE] is set to 0. This disables other 
external interrupts from interrupting the interrupt handler before SRRO and SRR?1 are saved. The 
MSR is also written with the other values shown in Table 5-9 on page 5-19. The high-order 16 bits of 
the program counter are written with the contents of the EVPR and the low-order 16 bits of the 
program counter are written with 0x0500. Interrupt processing begins at the address in the program 
counter. 


5-18 PPC405 Core User’s Manual 


Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter. 


Table 5-9. Register Settings during External Interrupts 


SRRO Written with the address of the next sequential instruction 

SRR1 Written with the contents of the MSR 

MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 

PC EVPRJ[0:15] || 0x0500 


5.11 Alignment Interrupt 


Alignment interrupts are caused by dcebz instructions to non-cachable or write-through storage, 
misaligned dcread, lwarx, or stwx. instructions, or misaligned APU or FPU loads/stores. Table 5-10 
summarizes the instructions and conditions causing alignment interrupts. 


Table 5-10. Alignment Interrupt Summary 


Instructions Causing Alignment 


Interrupts Conditions 
dcbz EA in non-cachable or write-through storage 
dcread, lwarx, stwex. EA not word-aligned 
APU or FPU load/store halfword EA not halfword-aligned 
APU or FPU load/store word EA not word-aligned 


APU or FPU load/store doubleword EA not word-aligned 


APU load/store quadword EA not quadword-aligned 


Execution of an instruction causing an alignment interrupt is prohibited from completing. SRRO is 
written with the address of that instruction and the current contents of the MSR are saved into SRR1. 
The DEAR is written with the address that caused the alignment error. The MSR bits are written with 
the values shown in Table 5-11 on page 5-19. The high-order 16 bits of the program counter are 
written with the contents of the EVPR and the low-order 16 bits of the program counter are written 
with 0x0600. Interrupt processing begins at the new address in the program counter. 


Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter 


Alignment interrupts cannot be disabled. To avoid overwrites of SRRO and SRR1 by alignment 
interrupts that occur within a handler, interrupt handlers should save these registers as soon as 
possible. 


Table 5-11. Register Settings during Alignment Interrupts 


SRRO Written with the address of the instruction causing the alignment interrupt 
SRR1 Written with the contents of the MSR 
MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 

CE, ME, DE < unchanged 
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Table 5-11. Register Settings during Alignment Interrupts (continued) 
PC EVPR[0:15] || Ox0600 
DEAR Written with the address that caused the alignment violation 


5.12 Program Interrupt 


Program interrupts are caused by attempting to execute: 


¢ An illegal instruction 

* A privileged instruction while in the problem state 

¢ Executing a trap instruction with conditions satisfied 
¢ An unimplemented APU or FPU instruction 

¢ An APU instruction with APU interrupt enabled 

¢ An FPU instruction with FPU interrupt enabled 


The ESR bits that differentiate these situations are listed and described in Table 5-12. When a 
program interrupt occurs, the appropriate bit is set and the others are cleared. These interrupts are 
not maskable. 


Table 5-12. ESR Usage for Program Interrupts 


Bits Interrupts Cause 
ESRI[PIL] | Illegal instruction Opcode not recognized 
ESR[PPR] | Privileged instruction Attempt to use a privileged instruction in the problem state 
ESR[PTR] | Trap Excepting instruction is a trap 
ESR[PEU] | Unimplemented An FPU or APU instruction is unimplemented 
ESR[PFP] | FPU Excepting instruction is an FPU instruction 
ESR[PAP] | APU Excepting instruction is an APU instruction 


The program interrupt handler does not need to reset the ESR. 


When one of the following occurs, the PPC405 does not execute the instruction, but writes the 
address of the excepting instruction into SRRO: 


¢ Attempted execution of a privileged instruction in problem state 


¢ Attempted execution of an illegal instruction (including memory management instructions when 
memory management is disabled or when TIEC405MmuEn = 0. 


When the TIEc405MmuEn signal is tied to 0, the TLB instructions (tlbia, tlbre, tlbsx, tlbsync, and 
tlbwe) are treated as illegal instructions. When execution of any of these instructions occurs under 
this circumstance, a program interrupt results. Trap instructions can be used as a program interrupt or 
a debug event, or both (see “Debug Events” on page 8-10 for information about debug events). When 
a trap instruction is detected as a program interrupt, the PPC405 writes the address of the trap 
instruction into SRRO. See tw on page 9-190 and twi on page 9-193 (both in Chapter 9, “Instruction 
Set”) for a detailed discussion of the behavior of trap instructions with various interrupts enabled. 
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Attempted execution of an APU instruction while the APUc405exception signal is asserted) results in 
a program interrupt. Similarly, attempted execution of an FPU instruction whilethe FPUc405exception 
signal is asserted) also results in a program interrupt. The following also result in program interrupts: 
attempted execution of an APU instruction while APUc405DcdAPUOp is asserted but 
APUC405DcdValidOp is deasserted; and attempted execution of an FPU instruction while 
APUc405DcdFpuOp but APUC405DcdValidOp is deasserted. 


After any program interrupt, the contents of the MSR ar MSR[APA] = 0, an attempt to execute an 
instruction intended for an APU causes a program interrupt if MSR[APE] = 0e written into SRR1 and 
the MSR bits are written with the values shown in Table 5-13. The high-order 16 bits of the program 
counter are written with the contents of the EVPR; the low-order 16 bits of the program counter are 
written with 0x0700. Interrupt processing begins at the new address in the program counter. 


Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter. 


Table 5-13. Register Settings during Program Interrupts 


SRRO Written with the address of the excepting instruction 

SRR1 Written with the contents of the MSR 

MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 

PC EVPR[0:15] || 0x0700 

ESR Written with the type of program interrupt. (See Table 5-12) 
MCI <— unchanged 
All other bits are cleared. 


5.13 FPU Unavailable Interrupt 


If MSR[FP] = 0, an attempt to execute an FPU instruction for which an FPU asserts 
APU_C405DcdFpuOp causes an FPU unavailable interrupt. The PPC405 FPU does not execute the 
instruction, but writes the address of the FPU instruction into SRRO. 


After an FPU unavailable interrupt occurs, the contents of the MSR are written into SRR1 and the 
MSR bits are written with the values shown in Table 5-13. The high-order 16 bits of the program 
counter are written with the contents of the EVPR; the low-order 16 bits of the program counter are 
written with 0x0800. Interrupt processing begins at the new address in the program counter. 


Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter. 


Table 5-14. Register Settings during FPU Unavailable Interrupts 


SRRO Written with the address of the excepting instruction 

SRR1 Written with the contents of the MSR 

MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 

PC EVPRJ[0:15] || 0x0800 
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5.14 System Call Interrupt 


System call interrupts occur when a sc instruction is executed. The PPC405 writes the address of the 
instruction following the sc into SRRO. The contents of the MSR are written into SRR1 and the MSR 
bits are written with the values shown in Table 5-15. The high-order 16 bits of the program counter are 
then written with the contents of the EVPR and the low-order 16 bits of the program counter are 
written with Ox0COO. Interrupt processing begins at the new address in the program counter. 


Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter. 


Table 5-15. Register Settings during System Call Interrupts 


SRRO Written with the address of the instruction following the sc instruction 
SRR1 Written with the contents of the MSR 
MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 
PC EVPR[0:15] || OxOCOO 


5.15 APU Unavailable Interrupt 


If MSR[AP] = 0, an attempt to execute an APU instruction for which an APU asserts 
APU_C405DcdApuOp causes an APU unavailable interrupt. The PPC405 does not execute the 
instruction, but writes the address of the APU instruction into SRRO. 


After an APU unavailable interrupt, the contents of the MSR are written into SRR1 and the MSR bits 
are written with the values shown in Table 5-16. The high-order 16 bits of the program counter are 
written with the contents of the EVPR; the low-order 16 bits of the program counter are written with 
Ox0F20. Interrupt processing begins at the new address in the program counter. 


Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter. 


Table 5-16. Register Settings during APU Unavailable Interrupts 


SRRO Written with the address of the excepting instruction 

SRR1 Written with the contents of the MSR 

MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 

PC EVPR[0:15] || OxOF20 


5.16 Programmable Interval Timer (PIT) Interrupt 


For a discussion of the PPC405 timer facilities, see Chapter 6, “Timer Facilities.” The PIT is described 
in “Programmable Interval Timer (PIT)” on page 6-4. 


If the PIT interrupt is enabled by TCR[PIE] and MSR[EE], the PPC405 initiates a PIT interrupt after 
detecting a time-out from the PIT. Time-out is detected when, at the beginning of a clock cycle, 
TSRIPIS] = 1. (This occurs on the cycle after the PIT decrements on a PIT count of 1.) The PPC405 
immediately takes the interrupt. The address of the next sequential instruction is saved in SRRO; 
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simultaneously, the contents of the MSR are written into SRR1 and the MSR is written with the values 
shown in Table 5-17. The high-order 16 bits of the program counter are then written with the contents 
of the EVPR and the low-order 16 bits of the program counter are written with 0x1000. Interrupt 
processing begins at the address in the program counter. 


To clear a PIT interrupt, the interrupt handling routine must clear the PIT interrupt bit, TSR[PIS]. 
Clearing is performed by writing a word to TSR, using an mtspr instruction, that has 1 in bit positions 
to be cleared and 0 in all other bit positions. The data written to the TSR is not direct data, but a mask; 
a 1 clears the bit and 0 has no effect. 


Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter. 


Table 5-17. Register Settings during Programmable Interval Timer Interrupts 


SRRO Written with the address of the next instruction to be executed 
SRR1 Written with the contents of the MSR 
MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 
PC EVPR[0:15] || 0x1000 
TSR PIS<1 


5.17 Fixed Interval Timer (FIT) Interrupt 


For a discussion of the PPC405 timer facilities, see Chapter 6, “Timer Facilities.” The FIT is described 
in “Fixed Interval Timer (FIT) Interrupt” on page 5-23. 


If the FIT interrupt is enabled by TCR[FIE] and MSR[EE], the PPC405 initiates a FIT interrupt after 
detecting a time-out from the FIT. Time-out is detected when, at the beginning of a clock cycle, 
TSRI[FIS] = 1. (This occurs on the second cycle after the 0 — 1 transition of the appropriate time-base 
bit.) The PPC405 immediately takes the interrupt. The address of the next sequential instruction is 
written into SRRO; simultaneously, the contents of the MSR are written into SRR1 and the MSR is 
written with the values shown in Table 5-18. The high-order 16 bits of the program counter are then 
written with the contents of the EVPR and the low-order 16 bits of the program counter are written 
with 0x1010. Interrupt processing begins at the address in the program counter. 


To clear a FIT interrupt, the interrupt handling routine must clear the FIT interrupt bit, TSR[FIS]. 
Clearing is performed by writing a word to TSR, using an mtspr instruction, that has 1 in any bit 
positions to be cleared and 0 in all other bit positions. The data written to the TSR is not direct data, 
but a mask; a 1 clears a bit and 0 has no effect. 
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Executing an rfi instruction restores the program counter from SRRO and the MSR from SRR1, and 
execution resumes at the address in the program counter. 


Table 5-18. Register Settings during Fixed Interval Timer Interrupts 


SRRO Written with the address of the next sequential instruction 

SRR1 Written with the contents of the MSR 

MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 

MSR WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 

PC EVPR[0:15] || 0x1010 

TSR FIS< 1 


5.18 Watchdog Timer Interrupt 


For a general description of the PPC405 timer facilities, see Chapter 6, “Timer Facilities.” The 
watchdog timer (WDT) is described in “Watchdog Timer” on page 6-6. 


If the WDT interrupt is enabled by TCR[WIE] and MSR[CE], the PPC405 initiates a WDT interrupt 
after detecting the first WDT time-out. First time-out is detected when, at the beginning of a clock 
cycle, TSR[WIS] = 1. (This occurs on the second cycle after the 0-1 transition of the appropriate 
time-base bit while TSR[ENW] = 1 and TSR[WIS] = 0.) The PPC405 immediately takes the interrupt. 
The address of the next sequential instruction is saved in SRR2; simultaneously, the contents of the 
MSR are written into SRR3 and the MSR is written with the values shown in Table 5-19. The high- 
order 16 bits of the program counter are then written with the contents of the EVPR and the low-order 
16 bits of the program counter are written with 0x1020. Interrupt processing begins at the address in 
the program counter. 


To clear the WDT interrupt, the interrupt handling routine must clear the WDT interrupt bit TSR[WIS]. 
Clearing is done by writing a word to TSR (using mtspr), with a 1 in any bit position that is to be 
cleared and 0 in all other bit positions. The data written to the status register is not direct data, but a 
mask; a 1 causes the bit to be cleared, and a 0 has no effect. 


Executing the return from critical interrupt instruction (rfci) restores the contents of the program 
counter and the MSR from SRR2 and SRR&, respectively, and the PPC405 resumes execution at the 
contents of the program counter. 


Table 5-19. Register Settings during Watchdog Timer Interrupts 


5-24 


SRR2 Written with the address of the next sequential instruction 

SRR3 Written with the contents of the MSR 

MSR AP, APE, WE, CE, EE, PR, FP, FEO, DE, DWE, FE1, IR, DR< 0 
ME < unchanged 

PC EVPR[0:15] || 0x1020 

TSR WIS < 1 
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5.19 Data TLB Miss Interrupt 


The data TLB miss interrupt is generated if data translation is enabled and a valid TLB entry matching 
the EA and PID is not present. The address of the instruction generating the untranslatable effective 
data address is saved in SRRO. In addition, the hardware also saves the data address (that missed in 
the TLB) in the DEAR. 


The ESR is set to indicate whether the excepting operation was a store (includes dcbz, dcbi, dccci). 
The interrupt is precise. Program flow vectors to EVPR[0:15] || 0x1100. 


The following registers are modified to the values specified in Table 5-20. 


Table 5-20. Register Settings during Data TLB Miss Interrupts 


SRRO Set to the address of the instruction generating the effective address for 
which no valid translation exists. 

SRR1 Set to the value of the MSR at the time of the interrupt 

MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 

PC EVPRJ[0:15] || 0x1100 

DEAR Set to the effective address of the failed access 

ESR DST <1 if excepting operation is a store operation (includes debi, dcbz, 
and dccci). 
MCI <— unchanged 
All other bits are cleared. 


Programming Note: Data TLB miss interrupts can happen whenever data translation is enabled. 
Therefore, ensure that SRRO and SRR1 are saved before enabling translation in an interrupt 
handler. 


5.20 Instruction TLB Miss Interrupt 


The instruction TLB miss interrupt is generated if instruction translation is enabled and execution is 
attempted for an instruction for which a valid TLB entry matching the EA and PID for the instruction 
fetch is not present. The instruction whose fetch caused the TLB miss is saved in SRRO. 


The interrupt is precise with respect to the attempted execution of the instruction. Program flow 
vectors to EVPR[0:15 || 0x1200. 


The following are modified to the values specified in Table 5-21. 


Table 5-21. Register Settings during Instruction TLB Miss Interrupts 


SRRO Set to the address of the instruction for which no valid translation exists. 
SRR1 Set to the value of the MSR at the time of the interrupt 
MSR AP, APE, WE, EE, PR, FP, FEO, DWE, FE1, IR, DR< 0 
CE, ME, DE < unchanged 
PC EVPR[0:15] || 0x1200 


Programming Note: Instruction TLB miss interrupts can happen whenever instruction translation 
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is active. Therefore, insure that SRRO and SRR1 are saved before enabling translation in an 
interrupt handler. 


5.21 Debug Interrupt 


Debug interrupts can be either synchronous or asynchronous. These debug events generate 
synchronous interrupts: branch taken (BT), data address compare (DAC), data value compare (DVC), 
instruction address compare (IAC), instruction completion (IC), and trap instruction (TIE). The 
exception (EXC) and unconditional (UDE) debug events generate asynchronous interrupts. See 
“Debug Events” on page 8-10 for more information about debug events. 


For debug events, SRR2 is written with an address, which varies with the type of debug event, as 
shown in Table 5-22. 


Table 5-22. SRR2 during Debug Interrupts 


Debug Event Address Saved in SRR2 

BT Address of the instruction causing the event 

DAC 

IAC 

TIE 

DVC Address of the instruction following the instruction that causing the event 

IC 

EXC Interrupt vector address of the initial exception that caused the exception debug event 
UDE Address of next instruction to be executed at time of UDE 


SRR3 is written with the contents of the MSR and the MSR is written with the values shown in 

Table 5-23 on page 5-26. The high-order 16 bits of the program counter are then written with the 
contents of the EVPR; the low-order 16 bits of the program counter are written with 0x2000. Interrupt 
processing begins at the address in the program counter. 


Executing an rfci instruction restores the program counter from SRR2 and the MSR from SRR3, and 
execution resumes at the address in the program counter. 


Table 5-23. Register Settings during Debug Interrupts 


SRR2 Written with an address as described in Table 5-22 

SRR3 Written with the contents of the MSR 

MSR AP, APE, WE, CE, EE, PR, FP, FEO, DE, DWE, FE1, IR, DR< 0 
ME < unchanged 

PC EVPR[0:15] || 0x2000 

DBSR Set to indicate type of debug event. 
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Chapter 6. Timer Facilities 


The PPC405 provides four timer facilities: a time base, a Programmable Interval Timer (PIT), a fixed 
interval timer (FIT), and a watchdog timer. The PIT is a Special Purpose Register (SPR). These 
facilities, which are driven by the same base clock, can, among other things, be used for: 

¢ Time-of-day functions 

¢ Data logging functions 

¢ Peripherals requiring periodic service 

¢ Periodic task switching 


Additionally, the watchdog timer can help a system to recover from faulty hardware or software. 


Figure 6-1 shows the relationship of the timers and the clock source to the time base. 


TBL (32 bits) TBU (32 bits) 
External 
wloek IS 0 31 0 31 
Source 
L— Bit3 (229 clocks) 
| Bit7 (225 clocks) 
‘ 4 Watchdog Timer Events 
t— Bit 11 (2°' clocks) 
L__ Bit 15 (2'7 clocks) 


Bit 11 (22! clocks) 
Bit 15 (2'” clocks) 
FIT Events 
Bit 19 (21? clocks) 
( 


Bit 23 (2° clocks) 


PIT (Decrementer) 


(32 bits) 


0 31 


L Zero Detect } PIT Events 


Figure 6-1. Relationship of Timer Facilities to the Time Base 


6.1. Time Base 
The PPC405 implements a 64-bit time base as required in The PowerPC Architecture. The time base, 


which increments once during each period of the source clock, provides a time reference. Read 
access to the time base is through the mftb instruction. mftb provides user-mode read-only access to 
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the time base. The TBR numbers (0x10C and 0x10D; TBL and TBU, respectively) that specify the 
time base registers to mftb are not SPR numbers. However, the PowerPC Architecture allows an 
implementation to handle mftb as mfspr. Accordingly, these register numbers cannot be used for 
other SPRs. PowerPC compilers cannot use mftb with register numbers other than those specified in 
the PowerPC Architecture as read-access time base registers (0x10C and 0x10D). 


Write access to the time base, using mtspr, is privileged. Different register numbers are used for read 
access and write access. Writing the time base is accomplished by using SPR 0x11C and SPR 
0x11D (TBL and TBU, respectively) as operands for mtspr. 


The period of the 64-bit time base is approximately 2925 years for a 200 MHz clock source. The time 
base does not generate interrupts, even when it wraps. For most applications, the time base is set 
once at system reset and only read thereafter. Note that the FIT and the watchdog timer (discussed 
below) are driven by 0-1 transitions of bits from the TBL. Transitions caused by software alteration of 
TBL have the same effect as transitions caused by normal incrementing of the time base. 


Figure 6-2 illustrates the TBL. 


Figure 6-2. Time Base Lower (TBL) 


0:31 Time Base Lower Current count; low-order 32 bits of time 
base. 


Figure 6-3 illustrates the TBU. 


Figure 6-3. Time Base Upper (TBU) 


0:31 Time Base Upper Current count, high-order 32 bits of time 
base. 
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Table 6-1 summarizes the TBRs, instructions used to access the TBRs, and access restrictions. 


Table 6-1. Time Base Access 


TBU 
Upper 
32 bits 


TBL 
Lower 
32 bits 


Register 
Instructions Number | Access Resirictions 
mftobu RT 0x10D Read-only 
Extended mnemonic for 
mftb RT, TBU 
mttbu RS 0x11D Privileged; write-only 
Extended mnemonic for 
mtspr TBU,RS 
mfto RT 0x10C Read-only 
Extended mnemonic for 
mftb RT,TBL 
mttbl RS 0x11C Privileged; write-only 
Extended mnemonic for 
mtspr TBL,RS 


6.1.1 Reading the Time Base 


The following code provides an example of reading the time base. mftb moves the low-order 32 bits 
of the time base to a GPR; mftbu moves the high-order 32 bits of the time base to a second GPR. 


loop: 
mftbu Rx 
mftb Ry 
mftbu Rz 
cmpw Rz, Rx 
bne_ loop 


# load from TBU 

# load from TBL 

# load from TBU 

# see if old = new 

# loop/reread if rollover occurred 


The comparison and loop ensure that a consistent pair of values is obtained. 


6.1.2 Writing the Time Base 


The following code provides an example of writing the time base. Writing the time base is privileged. 
mttbl moves the contents of a GPR to the low-order 32 bits of the time base; mttbu moves the 


contents of a second GPR to the high-order 32 bits of the time base. 


lwz Rx, upper 
lwz Ry, lower 


li Rz, 0 
mitb| Rz 
mttbu Rx 
mttbl Ry 


# load 64-bit time base value into Rx and Ry 


# force TBL to 0 to avoid rollover while writing TBU 
# set TBU 
# set TBL 
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6.2 Programmable Interval Timer (PIT) 


The PIT is a 32-bit SPR that decrements at the same rate as the time base. The PIT is read and 
written using mfspr and mtspr, respectively. Writing to the PIT also simultaneously writes to a hidden 
reload register. Reading the PIT using mfspr returns the current PIT contents; the hidden reload 
register cannot be read. When a non-zero value is written to the PIT, it begins to decrement. A PIT 
event occurs when a decrement occurs on a PIT count of 1. When a PIT event occurs, the following 
occurs: 


1. If the PIT is in auto-reload mode (the ARE field of the Timer Control Register (TCR) is 1), the PIT is 
loaded with the last value an mtspr wrote to the PIT. A decrement from a PIT count of 1 
immediately causes a reload; no intermediate PIT content of 0 occurs. 


If the PIT is not in auto-reload mode (TCR[ARE] = 0), a decrement from a PIT count of 1 simply 
causes a PIT content of 0. 


2. TSRIPIS] is set to 1. 


3. If enabled (TCR[PIE] = 1 and the EE field of the Machine State Register (MSR) is 1), a PIT 
interrupt is taken. See “Programmable Interval Timer (PIT) Interrupt” on page 5-22 for details of 
register behavior during a PIT interrupt. 


The interrupt handler should use software to reset the PIS field of the Timer Status Register (TSR). 
This is done by using mtspr to write a word to the TSR having a 1 in TSR[PIS] and any other bits to 
be cleared, and a 0 in all other bits. The data written to the TSR is not direct data, but a mask. A 1 
clears a bit; a O has no effect. 


Using mtspr to force the PIT to 0 does not cause a PIT interrupt. However, decrementing that was 
ongoing at the instant of the mtspr instruction can cause the appearance of an interrupt. To eliminate 
the PIT as a source of interrupts, write a 0 to TCR[PIE], the PIT interrupt enable bit. 


To eliminate all PIT activity: 
1. Write a 0 to TCR[PIE]. This prevents PIT activity from causing interrupts. 
2. Write a 0 to TCR[ARE]. This disables the PIT auto-reload feature. 


3. Write zeroes to the PIT to halt PIT decrementing. Although this action does not cause a pit PIT 
interrupt to become pending, a near-simultaneous decrement to 0 might have done so. 


4. Write a 1 to TSR[PIS] (PIT Interrupt Status bit). This clears TSR[PIS] to 0 (see “Timer Status 
Register (TSR)” on page 6-8). This also clears any pending PIT interrupt. Because the PIT stops 
decrementing, no further PIT events are possible. 


If the auto-reload feature is disabled (TCR[ARE] = 0) when the PIT decrements to 0, the PIT remains 
0 until software uses mtspr to reload it. 


After a reset, TCR[ARE] = 0, which disables the auto-reload feature. 
Figure 6-4 illustrates the PIT. 
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0 31 


Figure 6-4. Programmable Interval Timer (PIT) 


0:31 Programmed interval remaining Number of clocks remaining until the PIT 
event 


6.2.1. Fixed Interval Timer (FIT) 


The FIT provides timer interrupts having a repeatable period. The FIT is functionally similar to an 
auto-reload PIT, except that only a smaller fixed selection of interrupt periods are available. 


The FIT exception occurs on 0-1 transitions of selected bits from the time base, as shown in 
Table 6-2. 


Table 6-2. FIT Controls 


Period Period 
TCR[FP] TBL Bit (Time Base Clocks) _ | (200 Mhz Clock) 
0,0 23 2° clocks 2.56 usec 
0, 1 19 213 clocks 40.96 usec 
1,0 15 217 clocks 0.655 msec 
1,1 11 271 clocks 10.49 msec 


The TSRIFIS] field logs a FIT exception as a pending interrupt. A FIT interrupt occurs if TCR[FIE] and 
MSRIEE] are enabled at the time of the FIT exception. “Fixed Interval Timer (FIT) Interrupt” on 
page 5-23 describes register settings during a FIT interrupt. 


The interrupt handler should reset TSR[FIS]. This is done by using mtspr to write a word to the TSR 
having a 1 in TSR[FIS] and any other bits to be cleared, and a 0 in all other bits. The data written to 
the TSR is not direct data, but a mask. A 1 clears a bit and a 0 has no effect. 
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6.3. Watchdog Timer 


The watchdog timer aids system recovery from software or hardware faults. 


A watchdog timeout occurs on 0-1 transitions of a selected bit from the time base, as shown in the 
following table. 


Table 6-3. Watchdog Timer Controls 


Period Period 
TCR[WP] TBL Bit (Time Base Clocks) | (200 MHz Clock) 
0,0 15 2'7 clocks 0.655 msec 
0,1 11 277 clocks 10.49 msec 
1,0 7 2° clocks 0.168 sec 
1,1 3 2°9 clocks 2.684 sec 


If a watchdog timeout occurs while TSR[WIS] = 0 and TSR[ENW] = 1, a watchdog interrupt occurs if 
the interrupt is enabled by TCR[WIE] and MSR[CE]. “Watchdog Timer” on page 6-6 describes 
register behavior during a watchdog interrupt. 


The interrupt handler should reset the TSR[WIS] bit. This is done by using mtspr to write a word to 
the TSR having a 1 in TSR[WIS] and any other bits to be cleared, and a 0 in all other bits. The data 
written to the TSR is not direct data, but a mask. A 1 clears a bit and a 0 has no effect. 


If a watchdog timeout occurs while TSR[WIS] = 1 and TSR[ENW] = 1, a hardware reset occurs if 
enabled by a non-zero value of TCR[WRC]. In other words, a reset can occur if a watchdog timeout 
occurs while a previous watchdog timeout is pending. The assumption is that TSR[WIS] was not 
cleared because the processor could not execute the watchdog handler, leaving reset as the only way 
to restart the system. Note that after TCR[ WRC] is set to a non-zero value, it cannot be reset by 
software. This prevents errant software from disabling the watchdog timer reset capability. After a 
reset, the initial value of TCR[WRC] = 00. 
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Figure 6-5 describes the watchdog state machine. In the figure, numbers in parentheses refer to 
descriptions of operating modes that follow the table. 


Time-out, no interrupt 


2) Interrupt 
@) Haridler 


Time-out, no interrupt 


1) Interrupt 
() Handler 


(3) SW Loop 


Watchdog timeout occurred, watchdog 
interrupt will occur if enabled 


Value of TCR[WRC] 


00 No reset will occur 
01 Core reset 


Time-out 


10 Chip reset 
11 System reset 


Figure 6-5. Watchdog Timer State Machine 
Enable Next Watchdog 
Watchdog Timer Status 
TSR[ENW] TSR[WIS] Action When Timer Interval Expires 
0 0 Set TSR[ENW] = 1. 
0 i Set TSR[ENW] = 1. 
1 0 Set TSR[WIS] = 1. 


If TCR[WIE] = 1 and MSR[CE] = 1, then interrupt. 


Cause the watchdog reset action specified by 
TCR[WRC]. 

On reset, copy current TCR[WRC] to TSR[WRS] and 
clear TCR[WRC], disabling the watchdog timer. 


The controls described in Figure 6-5 imply three different ways of using the watchdog timer. The 
modes assume that TCR[WRC] was set to allow processor reset by the watchdog timer: 


1. Always take a pending watchdog interrupt, and never attempt to prevent its occurrence. (This mode 


is described in the preceding text.) 
a. Clear TSR[WIS] in the watchdog timer handler. 
b. Never use TSR[ENW]. 


2. Always take a pending watchdog interrupt, but avoid it whenever possible by delaying a reset until a 


second watchdog timer occurs. 


This assumes that a recurring code loop of known maximum duration exists outside the interrupt 


handlers, or that a FIT interrupt handler is operational. One of these mechanisms clears 
TSR[ENW] more frequently than the watchdog period. 


a. Clear TSR[ENW] to 0 in loop or in FIT interrupt handler. 
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To clear TSR[ENW], use mtspr to write a 1 to TSR[ENW] (and to any other bits that are to be 
cleared), with 0 in all other bit locations. 


b. Clear TSR[WIS] in watchdog timer handler. 


It is not expected that a watchdog interrupt will occur every time, but only if an exceptionally 
high execution load delays clearing of TSR[ENW] in the usual time frame. 


3. Never take a watchdog interrupt. 


This assumes that a recurring code loop of reliable duration exists outside the interrupt handlers, or 
that a FIT interrupt handler is operational. This method only guarantees one watchdog timeout 
period before a reset occurs. 


a. Clear TSR[WIS] in the loop or in FIT handler. 
b. Never use TSR[ENW] but have it set. 


6.4 Timer Status Register (TSR) 


The TSR can be accessed for read or write-to-clear. 


Status registers are generally set by hardware and read and cleared by software. The mfspr 
instruction reads the TSR. Clearing the TSR is performed by writing a word to the TSR, using mtspr, 
having a 1 in all fields to be cleared and a 0 in all other fields. The data written to the TSR is not direct 
data, but a mask. A 1 clears the field and a 0 has no effect. 


ENW WRS_ FIS 


ie eee 


0/1;2 3/4 6 31 
WIS PIS 
Figure 6-6. Timer Status Register (TSR) 
0 ENW | Enable Next Watchdog Software must reset TSR[ENW] = 0 after 
0 Action on next watchdog event is to set each watchdog timer event. 
TSR[ENW] = 1. 


1 Action on next watchdog event is 
governed by TSR[WIS]. 


1 WIS Watchdog Interrupt Status 
0 No Watchdog interrupt is pending. 
1 Watchdog interrupt is pending. 


2:3 WRS_| Watchdog Reset Status 

00 No Watchdog reset has occurred. 

01 Core reset was forced by the watchdog. 

10 Chip reset was forced by the watchdog. 

11 System reset was forced by the 
watchdog. 


4 PIS PIT Interrupt Status 
0 No PIT interrupt is pending. 
1 PIT interrupt is pending. 
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5 FIS FIT Interrupt Status 
0 No FIT interrupt is pending. 


1 FIT interrupt is pending. 


Reserved 


6.5 Timer Control Register (TCR) 


The TCR controls PIT, FIT, and watchdog timer operation. 


The TCR[WRC] field is cleared to 0 by all processor resets. (Chapter 3, “Initialization,” describes the 
types of processor reset.) This field is set only by software. However, hardware does not allow 
software to clear the field after it is set. After software writes a 1 to a bit in the field, that bit remains a 
1 until any reset occurs. This prevents errant code from disabling the watchdog timer reset function. 


All processor resets clear TCR[ARE] to 0, disabling the auto-reload feature of the PIT. 


WIE FP FIE 


31 


ARE 


Figure 6-7. Timer Control Register (TCR) 


0:1 WP Watchdog Period 
00 2'7 clocks 
01 221 clocks 
10 2% clocks 


11 229 clocks 


2:3 WRC _ | Watchdog Reset Control 

00 No Watchdog reset will occur. 

01 Core reset will be forced by the 
Watchdog. 

10 Chip reset will be forced by the 
Watchdog. 

11 System reset will be forced by the 


Watchdog. 


TCR[WRC] resets to 00. 

This field can be set by software, but 
cannot be cleared by software, except by a 
software-induced reset. 


4 WIE Watchdog Interrupt Enable 
0 Disable watchdog interrupt. 


1 Enable watchdog interrupt. 


5 PIE PIT Interrupt Enable 
0 Disable PIT interrupt. 


1 Enable PIT interrupt. 


6:7 FP FIT Period 
00 29 clocks 
01 2'3 clocks 
10 2!” clocks 


11 221 clocks 
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FIE 


FIT Interrupt Enable 


0 Disable FIT interrupt. 


1 Enable FIT interrupt. 


ARE 


Auto Reload Enable 
0 Disable auto reload. 
1 Enable auto reload. 


Disables on reset. 


10:31 


Reserved 
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Chapter 7. Memory Management 


The PPC405 has a 4-gigabyte (GB) address space, which is presented as a flat address space. The 
PPC405 memory management unit (MMU) performs address translation and protection functions. 
With appropriate system software, the MMU supports: 


* Translation of effective addresses to real addresses 

¢ Independent enabling of instruction and data address translation and protection 
« Page-level access control using the translation mechanism 

¢ Software control of page replacement strategy 

¢ Additional virtual-mode control of protection using zones 

« Real-mode write protection 


7.1. MMU Overview 


The instruction and integer units generate 32-bit effective addresses (EAs) for instruction fetches and 
data accesses, respectively. Instruction EAs are generated for sequential instruction fetches, and for 
instruction fetches causing changes in program flow (branches and interrupts). Data EAs are 
generated for load/store and cache control instructions. The MMU translates EAs into real addresses; 
the instruction cache unit (ICU) and data cache unit (DCU) use real addresses to access memory. 


The PPC405 MMU supports demand-paged virtual memory and other memory management 
schemes that depend on precise control of effective to real address mapping and flexible memory 
protection. Translation misses and protection faults cause precise interrupts. Sufficient information is 
available to correct the fault and restart the faulting instruction. 


The MMU divides storage into pages. A page represents the granularity of EA translation and 
protection controls. Eight page sizes (1KB, 4KB, 16KB, 64KB, 256KB, 1MB, 4MB, 16MB) are 
simultaneously supported. A valid entry for a page containing the EA to be translated must be in the 
translation lookaside buffer (TLB) for address translation to be performed. EAs for which no valid TLB 
entry exists cause TLB-miss interrupts. 


7.2 Address Translation 


Fields in the Machine State Register (MSR) control the use of the MMU for address translation. The 
instruction relocate (IR) field of the MSR controls translation for instruction accesses. The data 
relocate (DR) field of the MSR controls the translation mechanism for data accesses. These fields, 
specified independently, can be changed at any time by a program in supervisor state. Note that all 
interrupts clear MSR[IR, DR] and place the processor in the supervisor state. Subsequent discussion 
about translation and protection assumes that MSR[IR, DR] are set, enabling address translation. 


The processor references memory when it fetches an instruction, and when it executes load/store, 
branch, and cache control instructions. Processor accesses to memory use EAs to references a 
memory location. When translation is enabled, the EA is translated into a real address, as illustrated 
in Figure 7-1 on page 7-2. The ICU or DCU uses the real address for the access. (When translation is 
not enabled, the EA is already a real address.) 
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In address translation, the EA is combined with an 8-bit process ID (PID) to create a 40-bit virtual 
address. The virtual address is compared to all of the TLB entries. A matching entry supplies the real 
address for the storage reference. Figure 7-1 illustrates the process. 


32-bit EA 


PID Register [0:n-1] [n:31] 


) Effective Page Address Offset 


[0:23] [24:31] 


PID 


[8:n+7] [N+8:39] 


| PID Effective Page Address Offset 


40-bit Virtual Address 


Unified TLB 
64-entry Fully-associative Array 


[0:n-1] [n:31] 


Real Page Number Offset 


Note:nis determined by page size. See 
Table 7-1 on page 7-4. | 
32-bit Real Address 


Figure 7-1. Effective to Real Address Translation Flow 


7.3. Translation Lookaside Buffer (TLB) 


The TLB is hardware that controls translation, protection, and storage attributes. The instruction and 
data units share a unified fully-associative TLB, in which any page entry (TLB entry) can be placed 
anywhere in the TLB. TLB entries are maintained under program control. System software 
determines the TLB entry replacement strategy and the format and use of page state information. A 
TLB entry contains the information required to identify the page, to specify translation and protection 
controls, and to specify the storage attributes. 


7.3.1 Unified TLB 


The unified TLB (UTLB) contains 64 entries; each has a TLBHI (tag) portion and a TLBLO (data) 
portion, as described in Figure 7-2 on page 7-3. TLBHI contains 36 bits; TLBLO contains 32 bits. 
When translation is enabled, the UTLB tag portion compares some or all of EAg-2 with some or all of 
the effective page number EPNo.-2;, based on the size bits SIZEo.. All 64 entries are simultaneously 
checked for a match. If an entry matches, the corresponding data portion of the UTLB provides the 


7-2 PPC405 Core User’s Manual 


real page number (RPN), access control bits (ZSEL, EX, WR), and storage attributes (W, I, M, G, E, 
UO 


PID (Process ID) 
0 23 24 31 


| ID 


TLBHI (Tag entry) 
0 21 22 2425 26 27 |28 35 


EPN SIZE UO TID 


TLBLO (Data entry) 
0 21 22 23 24 2728293031 


| RPN lex|we ZSEL w | mje 


Figure 7-2. TLB Entries 


The virtual address space is extended by adding an 8-bit translation ID (TID) loaded from the Process 
ID (PID) register during a TLB access. The PID identifies one of 255 unique software entities, usually 
used as a process or thread ID. TLBHI[TID] is compared to the PID during a TLB look-up. 


Tag and data entries are written by copying data from GPRs and the PID, using the tlbwe instruction. 
Tag and data entries are read by copying data to GPRs and the PID, using the tlbre instruction. 
Software can search for specific entries using the tlbsx instruction. 


7.3.2 TLB Fields 


Each TLB entry describes a page that is enabled for translation and access controls. Fields in the 
TLB entry fall into four categories: 

¢ Information required to identify the page to the hardware translation mechanism 

* Control information specifying the translation 

¢ Access control information 

¢ Storage attribute control information 


7.3.2.1 Page Identification Fields 


When an EA is presented to the MMU for processing, the MMU applies several selection criteria to 
each TLB entry to select the appropriate entry. Although it is possible to place multiple entries into the 
TLB to match a specific EA and PID, this is considered a programming error, and the result of a TLB 
lookup for such an EA is undefined. The following fields in the TLB entry identify the page. Except as 
noted, all comparisons must succeed to validate an entry for subsequent use. 


EPN (effective page number, 22 bits) 


Compared to some number of the EAg-o1 bits presented to the MMU. The number of bits corresponds 
to the page size. 
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The exact comparison depends on the page size, as shown in Table 7-1. 


Table 7-1. TLB Fields Related to Page Size 


Page SIZE n Bits EPN to EA RPN Bits 
Size Field Compared Comparison Set to 0 
4KB 001 EPNo-149 © EAg-19 
16KB 010 EPNo:17 © EAg:17 


64KB 011 EPNo-15 © EAg-15 
256KB 100 EPNo-13 © EAg-13 
1MB 101 EPNo-11 @ EAo-14 
4MB 110 EPNo-9 © EAg-9 
16MB 111 EPNo-7 © EAg-7 


SIZE (page size, 3 bits) 

Selects one of the eight page sizes, 1KB—16MB, listed in Table 7-1. 

V (valid,1 bit) 

Indicates whether a TLB entry is valid and can be used for translation. 


A valid TLB entry implies read access, unless overridden by zone protection. TLB_entry[V] can be 
written using a tlbwe instruction. The tlbia instruction invalidates all TLB entries. 


TID (translation ID, 8 bits) 


Loaded from the PID register during a tlbwe operation. The TID value is compared with the PID value 
during a TLB access. The TID provides a convenient way to associate a translation with one of 255 
unique software entities, typically a process or thread ID maintained by operating system software. 
Setting TLBHI_entry[TID] = 0x00 disables TID-PID comparison and identifies a TLB entry as valid for 
all processes; the value of the PID register is then irrelevant. 


7.3.2.2. Translation Field 


When a TLB entry is identified as matching an EA (and possibly the PID), TLBLO_entry[RPN] defines 
how the EA is translated. 


RPN (real page number, 22 bits) 


Replaces some, or all, of EAp-21, depending on page size. For example, a 16KB page uses EAp.17 for 
comparison. The translation mechanism replaces EAp-17 with TLBLO_entry[RPN]o.47 to form the 
physical address, and EAjg.31 becomes the real page offset, as illustrated in Figure 7-1. 


Programming Note: Software must set all unused bits of RPN (as determined by page size) to 0. 
See Table 7-1. 
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7.3.2.3 Access Control Fields 
Several access controls are available in the UTLB entries. 
ZSEL (zone select, 4 bits) 


Selects one of 16 zone fields (ZO—Z15) from the Zone Protection Register (ZPR). The ZPR field bits 
can modify the access protection specified by the TLB_entry[V, EX, WR] bits of a TLB entry. Zone 
protection is described in detail in “Zone Protection” on page 7-14. 


EX (execute enable, 1 bit) 


When set (TLBLO_entry[EX] = 1), enables instruction execution at addresses within a page. ZPR 
settings can override TLBLO_entry[EX]; see “Zone Protection” on page 7-14, for more information. 


WR (write-enable 1 bit) 


When set (TLBLO_entry[WR] = 1), enables store operations to addresses in a page. ZPR settings 
can override TLBLO_entry[WR]; see “Zone Protection” on page 7-14. 


7.3.2.4 Storage Attribute Fields 


TLB entries contain bits that control and provide information about the storage control attributes. Four 
of the attributes (W, |, M, and G) are defined in the PowerPC Architecture. The E storage attribute is 
defined in the IBM PowerPC Embedded Environment. The U0 attribute is implementation-specific. 


W (write-through, 1 bit) 


When set (TLBLO_entry[W] = 1), stores are specified as write-through. If data in the referenced page 
is in the data cache, a store updates the cached copy of the data and the external memory location. 
Contrast this with a write-back strategy, which updates memory only when a cache line is flushed. 


In real mode, the Data Cache Write-through Register (DCWR) controls the write strategy. 


Note that the PowerPC Architecture does not support memory models in which write-through is 
enabled and caching is inhibited. It is considered a programming error to use these memory models; 
the results are undefined. 


I (caching inhibited,1 bit) 


When set (TLBLO_entry[I] = 1), a memory access is completed by using the location in main memory, 
bypassing the cache arrays. During the access, the accessed location is not put into the cache arrays. 


In real mode, the Instruction Cache Cachability Register (ICCR) and Data Cache Cachability Register 
(DCCR) control cachability. In these registers, the setting of the bit is reversed; 1 indicates that a 
storage control region is cachable, rather than caching inhibited. 


Note that the PowerPC Architecture does not support memory models in which write-through is 
enabled and caching is inhibited. It is considered a programming error to use these memory models; 
the results are undefined. 


It is considered a programming error if the target location of a load/store, dcbz, or fetch access to 
caching inhibited storage is in the cache; the results are undefined. It is not considered a 
programming error for the target locations of other cache control instructions to be in the cache when 
caching is inhibited. 
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M (memory coherent,1 bit) 


For implementations that support multiprocessing, the M storage attribute improves the performance 
of memory coherency management. Because the PPC405 does not provide multi-processor support 
or hardware support for data coherency, the M bit is implemented, but has no effect. 


G (guarded,1 bit) 


When set (TLBLO_entry[G] = 1), indicates that the hardware cannot speculatively access the location 
for pre-fetching or out-of-order load access. The G storage attribute is typically used to protect 
memory-mapped I/O from inadvertent access. Attempted execution of an instruction from a guarded 
data storage address while instruction address translation is enabled results in an instruction storage 
interrupt because data storage and memory mapped I/O (MMIO) addresses are not used to contain 
instructions. 


An instruction fetch from a guarded region does not occur until the execution pipeline is empty, thus 
guaranteeing that the access is necessary and therefore not speculative. For this reason, 
performance is degraded when executing out of guarded regions, and software should avoid 
unnecessarily marking regions of instruction storage as guarded. 


In real mode, the Storage Guarded Register (SGR) controls guarding. 
UO (user-defined attribute, 1 bit) 


When set (TLBLO[UO] = 1), indicates the user-defined attribute applies to the data in the associated 
page. 

In real mode, the Storage User-defined 0 Register (SUOR) controls the setting of the UO storage 
attribute. 

E (endian, 1 bit) 


When set (TLBLOJ[E] = 1), indicates that data in the associated page is stored in true little endian 
format. 


In real mode, the Storage Little-Endian Register (SLER) controls the setting of the E storage attribute. 


7.3.3. Shadow Instruction TLB 


To enhance performance, four instruction-side TLB entries are kept in a four-entry fully-associative 
shadow array. This array, called the instruction TLB (ITLB), helps to avoid TLB contention between 
instruction accesses to the TLB and load/store operations. Replacement and invalidation of the ITLB 
entries is managed by hardware. See “Shadow TLB Consistency” on page 7-7 for details. 


The ITLB can be considered a level-1 instruction-side TLB; the UTLB serves as the level-2 
instruction-side TLB. The ITLB is used only during instruction fetches for storing instruction address 
translations. Each ITLB entry contains the translation information for a page. The processor uses the 
ITLB for address translation of instruction accesses when MSR[IR] = 1. 
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7.3.3.1. ITLB Accesses 


The instruction unit accesses the ITLB independently of the rest of the MMU. ITLB accesses are 
transparent to the executing program, except that ITLB hits contribute to higher overall instruction 
throughput by allowing data address translations to occur in parallel. Therefore, when instruction 
accesses hit in the ITLB, the address translation mechanisms in the UTLB are available for use by 
data accesses simultaneously. 


The ITLB requests a new entry from the UTLB when an ITLB miss occurs. A four-cycle latency occurs 
at each ITLB miss that is also a UTLB hit; the latency is longer if it is also a UTLB miss, or if there is 
contention for the UTLB from the data side. A round-robin replacement algorithm replaces existing 
entries with new entries. 


7.3.4 Shadow Data TLB 


To enhance performance, eight data-side TLB entries are kept in a eight-entry fully-associative 
shadow array. This array, called the data TLB (DTLB), helps to avoid TLB contention between 
instruction accesses to the TLB and load/store operations. Replacement and invalidation of the DTLB 
entries is managed by hardware. See “Shadow TLB Consistency” on page 7-7 for details. 


The DTLB can be considered a level-1 data-side TLB; the UTLB serves as the level-2 data-side TLB. 
The DTLB is used only during instruction execute for storing data address translations. Each DTLB 
entry contains the translation information for a page. The processor uses the DTLB for address 
translation of data accesses when MSR[DR] = 1. 


7.3.4.1. DTLB Accesses 


The execute unit accesses the DTLB independently of the rest of the MMU. DTLB accesses are 
transparent to the executing program, except that DTLB hits contribute to higher overall instruction 
throughput by allowing instruction address translations to occur in parallel. Therefore, when data 
accesses hit in the DTLB, the address translation mechanisms in the UTLB are available for use by 
instruction accesses simultaneously. 


The DTLB requests a new entry from the UTLB when a DTLB miss occurs. A three-cycle latency 
occurs at each DTLB miss that is also a UTLB hit; the latency is longer if it is also a UTLB miss. If 
there is contention for the UTLB from the instruction side, the data side has priority. A round-robin 
replacement algorithm replaces existing entries with new entries. 


7.3.5 Shadow TLB Consistency 


To help maintain the integrity of the shadow TLBs, the processor invalidates the ITLB and DTLB 
contents when the following context-synchronizing events occur: 

¢ isync instruction 

¢ Processor context switch (all interrupts, rfi, rfci) 

* sc instruction 

If software updates a translation/protection mechanism (UTLB, PID, ZPR, or MSR) and must 


synchronize these updates with the ITLB and DTLB, the software must perform the necessary context 
synchronization. 


A typical example is the manipulation of the TLB by an operating system within an interrupt handler 
for a TLB miss. Upon entry to the interrupt handler, the contents of the ITLB and DTLB are invalidated 
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and translation is disabled. If the operating system simply made the TLB updates and returned from 


the handler (using rfi or rfci), no additional explicit software action would be required to synchronize 
the ITLB and DTLB. 


If, instead, the operating system enables translation within the handler and then performs TLB 
updates within the handler, those updates would not be effective in the ITLB and DTLB until rfi or rfci 
is executed to return from the handler. For those TLB updates to be reflected in the ITLB and DTLB 
within the handler, an isyne must be issued after TLB updates finish. Failure to properly synchronize 
the shadow TLBs can cause unexpected behavior. 


Programming Note: As a rule of thumb, follow software manipulation of an translation 


mechanism (if performed while translation is active) with a context-synchronizing operation 
(usually isync). 
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Figure 7-3 illustrates the relationship of the shadow TLBs and UTLB in address translation: 


Generate I-side Generate D-side 
Effective Address Effective Address 


Translation Disabled Translation Enabled Translation Enabled Translation Disabled 
(MSR{IR]=0) % (MSRI[IR] = 1) (MSR[DR] = 1) % (MSR[DR] = 0) 


No Translation Perform ITLB Perform DTLB No Translation 
Look-up Look-up 


ITLBHit | ITLB Miss DTLB Miss | DTLBHit 
O O 


Extract Real Perform UTLB Extract Real 
Address from ITLB Look-up Address from DTLB 
UTLB Hit UTLB Miss 


Continue I-cache Continue I-cache 
Access or D-cache 


Access 


|-Side TLB Miss 
or 


Extract Real 
Address from UTLB 


D-Side TLB Miss 
Exception 


Route Address Route Address 
to ITLB to DTLB 


Figure 7-3. ITLB/DTLB/UTLB Address Resolution 


7.4  TLB-Related Interrupts 


The processor relies on interrupt handling software to implement paged virtual memory, and to 
enforce protection of specified memory pages. 


When an interrupt occurs, the processor clears MSR[IR, DR]. Therefore, at the start of all interrupt 
handlers, the processor operates in real mode for instruction accesses and data accesses. Note that 
when address translation is disabled for an instruction fetch or load/store, the EA is equal to the real 
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address and is passed directly to the memory subsystem (including cache units). Such untranslated 
addresses bypass all memory protection checks that would otherwise be performed by the MMU. 


When translation is enabled, MMU accesses can result in the following interrupts: 
¢ Data storage interrupt 

¢ Instruction storage interrupt 

¢ Data TLB miss interrupt 

¢ Instruction TLB miss interrupt 


¢ Program interrupt 


7.4.1. Data Storage Interrupt 


A data storage interrupt is generated when data address translation is active, and the desired access 
to the EA is not permitted for one of the following reasons: 
¢ Inthe problem state 


— icbi, load/store, dcbz, or dcbf with an EA whose zone field is set to no access (ZPR[Zn] = 00). 
In this case, dcbt and debtst no-op, rather than cause an interrupt. Privileged instructions 
cannot cause data storage interrupts. 


— Stores, or dcbz, to an EA having TLB[WR] = 0 (write access disabled) and ZPR[Zn] + 11. (The 
privileged instructions dcbi and dccci are treated as “stores”, but cause program interrupts, 
rather than data storage interrupts.) 


¢ In supervisor state 
— Data store, dcbi, dcbz, or dccci to an EA having TLB[WR] = 0 and ZPR[Zn] other than 11 or 10. 


dcba does not cause data storage exceptions (cache line locking or protection). If conditions occur 
that would otherwise cause such an exception, dcba is treated as a no-op. 


“Zone Protection” on page 7-14 describes zone protection in detail. See “Data Storage Interrupt” on 
page 5-16 for a detailed discussion of the data storage interrupt. 


7.4.2 Instruction Storage Interrupt 


An instruction storage interrupt is generated when instruction address translation is active and the 
processor attempts to execute an instruction at an EA for which fetch access is not permitted, for any 
of the following reasons: 


¢ Inthe problem state 


Instruction fetch from an EA with ZPR[Zn] = 00. 
Instruction fetch from an EA having TLB_entry[EX] = 0 and ZPR[Zn] + 11. 
Instruction fetch from an EA having TLB_entry[G] = 1. 


¢ Inthe supervisor state 


Instruction fetch from an EA having TLB_entry[EX] = 0 and ZPR[Zn] other than 11 or 10. 
Instruction fetch from an EA having TLB_entry[G] = 1. 
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See “Zone Protection” on page 7-14 for a detailed discussion of zone protection. See “Instruction 
Storage Interrupt” on page 5-17 for a detailed discussion of the instruction storage interrupt. 


7.4.3. Data TLB Miss Interrupt 


A data TLB miss interrupt is generated if data address translation is enabled and a valid TLB entry 
matching the EA and PID is not present. The interrupt applies to data access instructions and cache 
operations (excluding cache touch instructions). 


See “Data TLB Miss Interrupt” on page 5-25 for a detailed discussion. 


7.4.4 Instruction TLB Miss Interrupt 


The instruction TLB miss interrupt is generated if instruction address translation is enabled and 
execution is attempted for an instruction for which a valid TLB entry matching the EA and PID for the 
instruction fetch is not present. 


See “Instruction TLB Miss Interrupt” on page 5-25 for a detailed discussion. 


7.4.5 Program Interrupt 


When the TIE_couMmuEn signal is tied to 0, the TLB instructions (tlbia, tlbre, tlbsx, tlbsync, and 
tlbwe) are treated as illegal instructions. When execution of any of these instructions occurs under 
this circumstance, a program interrupt results. 


See “Program Interrupt” on page 5-20 for a detailed discussion. 
When TIE_cpuMmuEn is tied to 0, MSR[IR,DR] = 0. 


Programming Note: When TIE_copuMmuEn is tied to 0, MSR[IR,DR] = 0 upon execution of an rfi 
or rfci instruction, even if an interrupt handler sets MSR[IR] = 1 or MSR[DR] = 1 in Save/Restore 
Register 0 (SRRO) or SRR3. 


See “Program Interrupt” on page 5-20 for a detailed discussion. 


7.5 TLB Management 


The processor does not imply any format for the page tables or the page table entries because there 
is no hardware support for page table management. Software has complete flexibility in implementing 
a replacement strategy, because software does the replacing. For example, software can “lock” TLB 
entries that correspond to frequently used storage by electing to never replace them, so that those 
entries are never cast out of the TLB. 


TLB management is performed by software with some hardware assist, consisting of: 


¢ Storage of the missed EA in the Save/Restore Register 0 (SRRO) for an instruction-side miss, or in 
the Data Exception Address Register (DEAR) for a data-side miss. 


¢ Instructions for reading, writing, searching, and invalidating the TLB, as described briefly in the 
following subsections. See Chapter 9, “Instruction Set,” for detailed instruction descriptions. 
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7.5.1. TLB Search Instructions (tlbsx/tlbsx.) 


tlbsx locates entries in the TLB, to find the TLB entry associated with an interrupt, or to locate 
candidate entries to cast out. tlbsx searches the UTLB array for a matching entry. The EA is the value 
to be matched; EA = (RA|0)+(RB). 


If the TLB entry is found, its index is placed in RT9¢-3. RT can then serve as the source register for a 
tlbre or tlbwe instruction to read or write the entry, respectively. If no match is found, the contents of 
RT are undefined. 


tlbsx. sets the Condition Register (CR) bit CROgg. The value of CROgg depends on whether an entry 
is found: CROEQ = 1 if an entry is found; CROgg = 0 if no entry is found. 


7.5.2 TLB Read/Write Instructions (tlbre/tlbwe) 


TLB entries can be accessed for reading and writing by tlbre and tlbwe, respectively. Separate 
extended mnemonics are available for the TLBHI (tag) and TLBLO (data) portions of a TLB entry. 


7.5.3 TLB Invalidate Instruction (tlbia) 
tlbia sets TLB_entry[V] = 0 to invalidate all TLB entries. All other TLB entry fields remain unchanged. 
Using tlbwe to set TLB_entry[V] = 0 invalidates a specific TLB entry. 


7.5.4 TLB Sync Instruction (tlbsync) 


tlbsync guarantees that all TLB operations have completed for all processors in a multi-processor 
system. PPC405 provides no multiprocessor support, so this instruction performs no function. The 
instruction is included to facilitate code portability. 


7.6 Recording Page References and Changes 


When system software manages virtual memory, the software views physical memory as a collection 
of pages. Each page is associated with at least one TLB entry. To manage memory effectively, system 
software often must know whether a particular page has been referenced or modified. Note that this 
involves more than knowing whether a particular TLB entry was used to reference or alter memory, 
because multiple TLB entries can translate to the same page. 


When system software manages a demand-paged environment, and the software needs to replace 
the contents of a page with other data, previously referenced pages (accessed for any purpose) are 
more likely to be maintained than pages that were never referenced. If the contents of a page must be 
replaced, and data contained in that page was modified, system software generally must write the 
contents of the modified page to the backing store before replacing its contents. System software 
must maintain records to control the environment. 


Similarly, when system software manages TLB entries, the software often must know whether a 
particular TLB entry was referenced. When the system software must select a TLB entry to cast out, 
previously referenced entries are more likely to be maintained than entries which were never 
referenced. System software must also maintain records for this purpose. 
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The PPC405 does not provide hardware reference or change bits, but TLB miss interrupts and data 
storage interrupts enable system software to maintain reference information for TLB entries and their 
associated pages, respectively. 


A possible algorithm follows. First, the TLB entries are built, with each TLB_entry[V, WR] = 0. System 
software retains the index and EPN of each entry. 


The first attempt by application code to access a page causes a TLB miss interrupt, because its TLB 
entry is marked invalid. The TLB miss handler records the reference to the TLB entry (and to the 
associated page) in a data structure, then sets TLB_entry[V] = 1. (Note that TLB_entry[V] can be 
considered a reference bit for the TLB entry.) Subsequent read accesses to the page associated with 
the TLB entry proceed normally. 


In the example just given for recording TLB entry references, the first write access to the page using 
the TLB entry, after the entry is made valid, causes a data storage interrupt because write access was 
turned off. The TLB miss handler records the write to the page in a data structure, for use as a 
“changed” flag, then sets TLB_entry[WR] = 1 to enable write access. (Note that TLB_entry[WR] can 
be considered a change bit for the page.) Subsequent write accesses to the page proceed normally. 


7. Access Protection 


The PPC405 provides virtual-mode access protection. The TLB entry enables system software to 
control general access for programs in the problem state, and control write and execute permissions 
for all pages. The TLB entry can specify zone protection that can override the other access control 
mechanisms supported in the TLB entries. 


TLB entry and zone protection methods also support access controls for cache operation and string 
loads/stores. 


7.7.1. Access Protection Mechanisms in the TLB 


For MMU access protection to be in effect, one or both of MSR[IR] or MSR[DR] must be set to one to 
enable address translation. MSR[IR] enables protection on instruction fetches, which are inherently 
read-only. MSR[DR] enables protection on data accesses (loads/stores). 


7.7.1.1 General Access Protection 


The translation ID (TLB_entry[TID]) provides the first level of MMU access protection. This 8-bit field, 
if non-zero, is compared to the contents of TLB_entry[PID]. These fields must match in a valid TLB 
entry if any access is to be allowed. In typical use, it is assumed that a program in the supervisor 
state, such as a real-time operating system, sets the PID before starting a problem state program that 
is subject to access control. 


Memory Management 7-13 


If TLB_entry[TID] = 0x00, the associated memory page is accessible to all programs, regardless of 
their PID. This enables multiple processes to share common code and data. The common area is still 
subject to all other access protection mechanisms. Figure 7-4 illustrates the PID. 


Figure 7-4. Process ID (PID) 


0:23 Reserved 
24:31 Process ID 


7.7.1.2 Execute Permissions 


If instruction address translation is enabled, instruction fetches are subject to MMU translation and 
have MMU access protection. Fetches are inherently read-only, so write protection is not needed. 
Instead, using TLB_entry[EX], a memory page is marked as executable (contains instructions) or not 
executable (contains only data or memory-mapped control hardware). 


If an instruction is pre-fetched from a memory page for which TLB_entry[EX] = 0, the instruction is 
tagged as an error. If the processor subsequently attempts to execute this instruction, an instruction 
storage interrupt results. This interrupt is precise with respect to the attempted execution. If the 
fetcher discards the instruction without attempting to execute it, no interrupt will result. 


Zone protection can alter execution protection. 


7.7.1.3 Write Permissions 


If MSR[DR] = 1, data loads and stores are subject to MMU translation and are afforded MMU access 
protection. The existence of a TLB entry describing a memory page implies read access; write access 
is controlled by TLB_entry[WR]. 


If a store (including those caused by dcbz, debi, or dccci) is made to an EA having 
TLB_entry[WR] = 0, a data storage interrupt results. This interrupt is precise. 


Zone protection can alter write protection (see “Zone Protection” on page 7-14). In addition, only zone 
protection can prevent read access of a page defined by a TLB entry. 


7.7.1.4 Zone Protection 


Each TLB entry contains a 4-bit zone select (ZSEL) field. A zone is an arbitrary identifier for grouping 
TLB entries (memory pages) for purposes of protection. As many as 16 different zones may be 
defined. Any zone can have any number of member pages. 


Each zone is associated with a 2-bit field (ZO—Z15) in the ZPR. The values of the field define how 
protection is applied to all pages that are member of that zone. Changing the value of the ZPR field 
can alter the protection attributes of all pages in the zone. Without ZPR, the change would require 
finding, reading, altering, and rewriting the TLB entry for each page in a zone, individually. The ZPR 
provides a much faster means of altering the protection for groups of memory pages. 
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The ZSEL values 0-15 select ZPR fields ZO—Z15, respectively. 


The fields are defined within the ZPR as follows: 


While it is common for TLB_entry[EX, WR] to be identical for all member pages in a group, this is not 
required. The ZPR field alters the protection defined by TLB_entry[EX] and TLB_entry[WR], ona 
page-by-page basis, as shown in the ZPR illustration. An application program (presumed to be 
running in the problem state) can have execute and write permissions as defined by TLB_entry[EX] 
and TLB_entry[WR] for the individual pages, or no access (denies loads, as well as stores and 
execution), or complete access. 


ZO Z4 Z6 Z8 Z10 Z12 214 
01/2 3/4 6 7)8 9/10 11/12 13/14 15)16 17/18 19/20 21) 22 23/24 25/26 27/28 29/30 31 
Z1 23 Z5 Z7 Z11 Z13 Z15 
Figure 7-5. Zone Protection Register (ZPR) 
0:1 ZO TLB page access control for all pages in this zone. 
In the problem state (MSR[PR] = 1): In the supervisor state (MSR[PR] = 0): 
00 No access 00 Access controlled by applicable 
01 Access controlled by applicable TLB_entry[EX, WR] 
TLB_entry[EX, WR] 01 Access controlled by applicable 
10 Access controlled by applicable TLB_entry[EX, WR] 
TLB_entry[EX, WR] 10 Accessed as if execute and write 
11 Accessed as if execute and write permissions (TLB_entry[EX, WR]) are 
permissions (TLB_entry[EX, WR]) are granted 
granted 11 Accessed as if execute and write 
permissions (TLB_entry[EX, WR]) are 
granted 
2:3 Z1 See the description of ZO. 
4:5 Z2 See the description of ZO. 
6:7 Z3 See the description of ZO. 
8:9 Z4 See the description of ZO. 
10:11 | Z5 See the description of ZO. 
12:13 | Z6 See the description of ZO. 
14:15 | 27 See the description of ZO. 
16:17 | Z8 See the description of ZO. 
18:19 | Z9 See the description of ZO. 
20:21 | 210 See the description of ZO. 
22:23 | Z11 See the description of ZO. 
24:25 | 212 See the description of ZO. 
26:27 | 213 See the description of ZO. 
28:29 | 214 See the description of ZO. 
30:31 | Z15 See the description of ZO. 
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Setting ZPR[Zn] = 00 for a ZPR field is the only way to deny read access to a page defined by an 
otherwise valid TLB entry. TLB_entry[EX] and TLB_entry[WR] do not support read protection. Note 
that the icbi instruction is considered a load with respect to access protection; executed in user 
mode, it causes a data storage interrupt if MSR[DR] = 1 and ZPR[Zn] = 00 is associated with the EA. 


For a given ZPR field value, a program in supervisor state always has equal or greater access than a 
program in the problem state. System software can never be denied read (load) access for a valid 
TLB entry. 


7.7.2 Access Protection for Cache Control Instructions 


Architecturally the instructions dcba, dcbi, and dcbz are treated as “stores” because they can 
change data, or cause loss of data by invalidating a dirty line (a modified cache block). 


Table 7-2 summarizes the conditions under which the cache control instructions can cause data 
storage interrupts. 


Table 7-2. Protection Applied to Cache Control Instructions 


Possible Data Storage interrupt 

Instruction | When ZPR[Zn] =00 | When TLB_entry[WR] = 0 
dcba No (instruction no-ops) | No (instruction no-ops) 
dcbf Yes No 

dcbi No Yes 

dcbst Yes No 

dcbt No (instruction no-ops) | No 

dcbtst No (instruction no-ops) | No 

dcbz Yes Yes 

dccci No Yes 

dcread No No 

icbi Yes No 

icbt No (instruction no-ops) | No 

iccci No No 

icread No No 


If data address translation is enabled, and write permission is denied (TLB_entry[WR] = 0), dcbi and 
dcbz can cause data storage interrupts. dcbz can cause a data storage interrupt when executed in 
the problem state and all access is denied (ZPR[Zn] = 00); dcbi cannot cause a data storage interrupt 
because it is a privileged instruction. 


The deba instruction enables “speculative” line establishment in the cache arrays; the established 
lines do not cause a line fill. Because the effects of dcba are speculative, interrupts that would 
otherwise result when ZPR[Zn] = 00 or TLB_entry[WR] = 0 do not occur. In such cases, dcba is 
treated as a no-op. 


The dccci instruction can also be considered a “store” because it can change data by invalidating a 
dirty line; however, decci is not address-specific (it affects an entire congruence class regardless of 
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the operand address of the instruction). To restrict possible damage from an instruction which can 
change data and yet avoids the protection mechanism, the dcecci instruction is privileged. 


If data address translation is enabled, dccci can cause data storage interrupts when 
TLB_entry[WR] = 0; the operand is treated as if it were address-specific. dccci cannot cause a data 
storage interrupt when ZPR[Zn] = 00, because it is a privileged instruction. 


Because dccci can cause data storage and TLB -miss interrupts, use of decci is not recommended 
when MSRI[DR] = 1; if decci is used. Note that the specific operand address can cause an interrupt. 


Architecturally, dcbt and debtst are treated as “loads” because they do not change data; they cannot 
cause data storage interrupts when TLB_entry[WR] = 0. 


The cache block touch instructions dcbt and debtst are considered “speculative” loads; therefore, if a 
data storage interrupt would otherwise result from the execution of dcbt or dcbtst when 

ZPR[Zn] = 00, the instruction is treated as a no-op and the interrupt does not occur. Similarly, TLB 
miss interrupts do not occur for these instructions. 


Architecturally, dcbf and dcbst are treated as “loads”. Flushing or storing a line from the cache is not 
architecturally considered a “store” because a store was performed to update the cache, and debf or 
dcbst only update main memory. Therefore, neither dcbf nor dcbst can cause data storage 
interrupts when TLB_entry[WR] = 0. Because neither instruction is privileged, they can cause data 
storage interrupts when ZPR[Zn] = 00 and data address translation is enabled. 


dcread is a “load” from a non-specific address, and is privileged. Therefore, it cannot cause data 
storage interrupts when ZPR[Zn] = 00 or TLB_entry[WR] = 0. 


icbi and icbt are considered “loads” and cannot cause data storage interrupts when 
TLB_entry[WR] = 0. icbi can cause data storage interrupts when ZPR[Zn] = 00. 


The iccci instruction cannot change data; an instruction cache line cannot be dirty. The iccci 
instruction is privileged and is considered a load. It does not cause data storage interrupts when 
ZPR[Zn] = 00 or TLB_entry[WR] = 0. 


Because iccci can cause a TLB miss interrupt, using iccci is not recommended when data address 
translation is enabled; if it is used, note that the specific operand address can cause an interrupt. 


icread is considered a “load” from a non-specific address, and is privileged. Therefore, it cannot 
cause data storage interrupts when ZPR[Zn] = 00 or TLB_entry[WR] = 0. 

7.7.3 Access Protection for String Instructions 

The stswx instruction with string length equal to O(XER[TBC] = 0) is a no-op. 


When data address translation is enabled and the Transfer Byte Count (TBC) field of the Fixed Point 
Exception Register (XER) is 0, neither Iswx nor stswx can cause TLB miss interrupts, or data 
storage interrupts when ZPR[Zn] = 0 or TLB_entry[WR] = 0. 


7.8 Real-Mode Storage Attribute Control 


The PowerPC Architecture and the PowerPC Embedded Environment define several SPRs to control 
the following storage attributes in real mode: W, |, G,UO, and E. Note that the UO and E attributes are 
not defined in the PowerPC Architecture. The E attribute is defined in the IBM PowerPC Embedded 
Environment, and the UO attribute is implementation-specific. No storage attribute control register is 
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implemented for the M storage attribute because the PPC405 does not provide multi-processor 
support or hardware support for data coherency. 


These SPRs, called storage attribute control registers, control the various storage attributes when 
address translation is disabled. When address translation is enabled, these registers are ignored, and 
the storage attributes supplied by the TLB entry are used (see “TLB Fields” on page 7-3). 


The storage attribute control registers divide the 4GB real address space into thirty-two 128MB 
regions. In a storage attribute control register, bit 0 controls the lowest addressed 128MB region, bit 1 
the next higher-addressed 128MB region, and so on. EAo-4 specify a storage control region. 


For detailed information on the function of the storage attributes, see “Storage Attribute Fields” on 
page 7-5. 
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7.8.1. Storage Attribute Control Registers 


Figure 7-6 shows a generic storage attribute control register. The storage attribute control registers 
have the same bit numbering and address ranges. 


0/1}2)3)4)5| 6) 7) 8) 9) 10/11) 12/13) 14) 15) 16} 17) 18) 19) 20) 21) 22) 23) 24 | 25) 26| 27) 28| 29) 3031 


Figure 7-6. Generic Storage Attribute Control Register 


Bit Address Range Bit Address Range 

0 | 0x0000 0000 -0x07FF FFFF 16 | 0x8000 0000—0x87FF FFFF 
1 | 0x0800 0000 —Ox0FFF FFFF 17 | 0x8800 0000—0x8FFF FFFF 
2 | 0x1000 0000—0x17FF FFFF 18 | 0x9000 0000—-0x97FF FFFF 
3 | 0x1800 0000—0x1FFF FFFF 19 | 0x9800 0000—0x9FFF FFFF 
4 | 0x2000 0000 -0x27FF FFFF 20 | 0xA000 0000 —-0xA7FF FFFF 
5 | 0x2800 0000-Ox2FFF FFFF | 21 | 0xA800 0000—OxAFFF FFFF 
6 | 0x3000 0000-0x37FF FFFF 22 | 0xB000 0000 —-0xB7FF FFFF 
7 | 0x3800 0000-Ox3FFF FFFF | 23 | 0xB800 0000—OxBFFF FFFF 
8 | 0x4000 0000-0x47FF FFFF | 24 | 0xC000 0000—0xC7FF FFFF 
9 | 0x4800 0000-0x4FFF FFFF 25 | 0xC800 0000 -OxCFFF FFFF 
10 | 0x5000 0000—0x57FF FFFF 26 | 0xD000 0000—0xD7FF FFFF 
11 | 0x5800 0000-Ox5FFF FFFF | 27 | 0xD800 0000—OxDFFF FFFF 
12 | 0x6000 0000—0x67FF FFFF 28 | 0xE000 0000 —-0xE7FF FFFF 
13 | 0x6800 0000 —-Ox6FFF FFFF 29 | OxE800 0000—OxEFFF FFFF 
14 | 0x7000 0000-—0x77FF FFFF 30 | OxF000 0000—OxF7FF FFFF 
15 | 0x7800 0000 -—Ox7FFF FFFF 31 | OxF800 0000—OxFFFF FFFF 


7.8.1.1. Data Cache Write-through Register (DCWR) 


The DCWR controls write-through policy (the W storage attribute) for the data cache unit (DCU). 
Write-through is not applicable to the instruction cache unit (ICU). 


After any reset, all DCWR bits are set to 0, which establishes a write-back write strategy for all 
regions. 


The PowerPC Architecture does not support memory models in which write-through is enabled and 
caching is inhibited. 
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7.8.1.2 Data Cache Cachability Register (DCCR) 


The DCCR controls the | storage attribute for data accesses and cache management instructions. 
Note that the polarity of the bits in this register is opposite to that of the | attribute in the TLB; 
DCCR[Sn] = 1 enables caching, while TLB_entry[l] = 1 inhibits caching. 


After any reset, all DCCR bits are set to 0. No memory regions are cachable. Before memory regions 
can be designated as cachable in the DCCR, it is necessary to execute the decci instruction once for 
each congruence class in the DCU cache array. This procedure invalidates all congruence classes. 
The DCCR can then be reconfigured, and the DCU can begin normal operation. 


The PowerPC Architecture does not support memory models in which write-through is enabled and 
caching is inhibited. 
7.8.1.3 Instruction Cache Cachability Register (ICCR) 


The ICCR controls the | storage attribute for instruction fetches. Note that the polarity of the bits in this 
register is opposite of that of the | attribute (ICCR[Sn] = 1 enables caching, while TLB_entry[l] = 1 
inhibits caching). 


After any reset, all ICCR bits are set to 0. No memory regions are cachable. Before memory regions 
can be designated as cachable in the ICCR, it is necessary to execute the iccci instruction. This 
procedure invalidates all congruence classes. The ICCR can then be reconfigured, and the ICU can 
begin normal operation. 


7.8.1.4 Storage Guarded Register (SGR) 
The SGR controls the G storage attribute for instruction and data accesses. 


This attribute does not affect data accesses; the PPC405 does not perform speculative loads or 
stores. 


After any reset, all SGR bits are set to 1, marking all storage as guarded. For best performance, 
system software should clear the guarded attribute of appropriate regions as soon as possible. If 
MSRIIR] = 1, the G attribute comes from the TLB entry. Attempting to execute from a guarded region 
in translate mode causes an instruction storage interrupt. See “Instruction Storage Interrupt” on 
page 5-17 for more information. 


7.8.1.5 Storage User-defined 0 Register (SUOR) 


The Storage User-defined 0 Register (SUOR) controls the user-defined (U0) storage attribute for 
instruction and data accesses. 


After any reset, all SUOR bits are set to 0. 


7.8.1.6 Storage Little-Endian Register (SLER) 
The SLER controls the E storage attribute for instruction and data accesses. 


This attribute determines the byte ordering of storage. “Byte Ordering” on page 2-17 provides a 
detailed description of byte ordering in the IBM PowerPC Embedded Environment. 


After any reset, all SLER bits are set to 0 (big endian). 
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Chapter 8. Debugging 


The debug facilities of the PPC405 include support for debug modes for debugging during hardware 
and software development, and debug events that allow developers to control the debug process. 
Debug registers control the debug modes and debug events. The debug registers are accessed 
through software running on the processor or through a JTAG debug port. The debug interface is the 
JTAG debug port. The JTAG debug port can also be used for board test. 


The debug modes, events, controls, and interface provide a powerful combination of debug facilities 
for a wide range of hardware and software development tools. 


8.1 Development Tool Support 


The RlISCWatch product from IBM is an example of a development tool that uses the external debug 
mode, debug events, and the JTAG debug port to implement a hardware and software development 
tool. The RISCTrace™ feature of RISCWatch is an example of a development tool that uses the real- 
time trace capability of the PPC405. 


8.2 Debug Modes 

The PPC405 supports the following debug modes, each of which supports a type of debug tool or 
debug task commonly used in embedded systems development: 

¢ Internal debug mode, which supports ROM monitors 

¢ External debug mode, which supports JTAG debuggers 


¢ Debug wait mode, which supports processor stopping or stepping for JTAG debuggers while 
servicing interrupts 


¢ Real-time trace mode, which supports trigger events for real-time tracing 


Internal and external debug modes can be enabled simultaneously. Both modes are controlled by 
fields in Debug Control Register 0 (DBCRO). Real-time trace mode is available only if internal, 
external, and debug wait modes are disabled. 


8.2.1. Internal Debug Mode 


Internal debug mode provides access to architected processor resources and supports setting 
hardware and software breakpoints and monitoring processor status. In this mode, debug events 
generate debug interrupts, which can interrupt normal program flow so that monitor software can 
collect processor status and alter processor resources. 


Internal debug mode relies on exception handling software at a dedicated interrupt vector and an 
external communications path to debug software problems. This mode, used while the processor 
executes instructions, enables debugging of operating system or application programs. 


In this mode, debugger software is accessed through a communications port, such as a serial port, 
external to the processor core. 
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To enable internal debug mode, the Debug Control Register 0 (DBCRO) field IDM is set to 1 
(DBCRO[IDM] = 1). To enable debug interrupts, MSR[DE] = 1. A debug interrupt occurs on a debug 
event only if DBCRO[IDM] = 1 and MSR[DE] = 1. 


8.2.2 External Debug Mode 


External debug mode provides access to architected processor resources and supports stopping, 
starting, and stepping the processor, setting hardware and software breakpoints, and monitoring 
processor status. In this mode, debug events cause the processor to become architecturally frozen. 
While the processor is frozen, normal instruction execution stops and architected processor 
resources can be accessed and altered. External bus activity continues in external debug mode. 


The JTAG mechanism can pass instructions to the processor for execution, allowing a JTAG debugger 
to display and alter processor resources, including memory. 


The JTAG mechanism prevents the occurrence of a privileged exception when a privileged instruction 
is executed while the processor is in user mode. 


Storage access control by a memory management unit (MMU) remains in effect while in external 
debug mode; the debugger may need to modify MSR or TLB values to access protected memory. 


Because external debug mode relies only on internal processor resources, it can be used to debug 
system hardware and software. 


In this mode, access to the processor is through the JTAG debug port. 


To enable external debug mode, DBCRO[EDM] = 1. To enable debug interrupts, MSR[DE] = 1. A 
debug interrupt occurs on a debug event only if DBCRO[EDM] = 1 and MSR[DE] = 1. 


8.2.3. Debug Wait Mode 


In debug wait mode, debug events cause the PPC405 to enter a state in which interrupts can be 
serviced while the processor appears to be stopped. 


Debug wait mode provides access to architected processor resources in a manner similar to external 
debug mode, except that debug wait mode allows the servicing of interrupt handlers. It supports 
stopping, starting, and stepping the processor, setting hardware and software breakpoints, and 
monitoring processor status. In this mode, if a debug event caused the processor to become 
architecturally frozen, an interrupt causes the processor to run an interrupt handler and return to the 
architecturally frozen state upon returning from the interrupt handler. While the processor is frozen, 
normal instruction execution stops and architected processor resources can be accessed and altered. 
External bus activity continues in debug wait mode. 


The processor enters debug wait mode when internal and external debug modes are disabled 
(DBCRO[IDM, EDM] = 0), debug wait mode is enabled (MSR[DWE] = 1), debug wait is enabled by the 
JTAG debugger, and a debug event occurs. 


For example, while the PPC405 core is in debug wait mode, an external device might generate an 
interrupt that requires immediate service. The PPC405 core can service the interrupt (vector to an 
interrupt handler and execute the interrupt handler code) and return to the previous stopped state. 


Debug wait mode relies only on internal processor resources, so it can be used to debug both system 
hardware and software problems. This mode can also be used for software development on systems 
without a control program, or to debug control program problems. 
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In this mode, access to the processor is through the JTAG debug port. 


8.2.4 Real-time Trace Debug Mode 


Real-time trace debug mode supports the generation of trigger events for tracing the instruction 
stream being executed out of the instruction cache in real-time. In this mode, debug events can be 
used to control the collection of trace information through the use of trigger event generation. The 
broadcast of trace information is independent of the use of debug events as trigger events. This mode 
does not alter the processor performance. 


A trace event occurs when internal and external debug modes are disabled (DBCRO[IDM, EDM] = 0) 
and a debug events occurs. 


When a trace event occurs, a trace device can capture trace signals that provide the instruction trace 
information. Most trace events generated from debug events are blocked when internal debug, 
external debug, or debug wait modes are enabled 


8.3. Processor Control 


The PPC405 provides the following debug functions for processor control. Not all facilities are 
available in all debug modes. 


Instruction Step The processor is stepped one instruction at a time, while stopped, using the 
JTAG debug port. 


Instruction Stuff While the processor is stopped, instructions can be stuffed into the processor 
and executed using the JTAG debug port. 


Halt The processor can be stopped by activating an external halt signal on an 
external event, such as a logic analyzer trigger. This signal freezes the 
processor architecturally. While frozen, normal instruction execution stops and 
architected processor resources can be accessed and altered using the JTAG 
debug port. Normal execution resumes when the halt signal is deactivated. 


Stop The processor can be stopped using the JTAG debug port. Activating a stop 
causes the processor to become architecturally frozen. While frozen, normal 
instruction execution stops and the architected processor resources can be 
accessed and altered using the JTAG debug port. 


Reset An external reset signal, the JTAG debug port, or DBCRO can request core, 
chip, and system resets. 
Debug Events A debug event triggers a debug operation. The operation depends on the 


debug mode. For more information and a list of debug events, see “Debug 
Events” on page 8-10. 


Freeze Timers The JTAG debug port or DBCRO can control timer resources. The timers can 
be enabled to run, freeze always, or freeze on a debug event. 


Trap Instructions — The trap instructions tw and twi can be used, with debug events, to implement 
software breakpoints. 
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8.4 Processor Status 


The processor execution status, exception status, and most recent reset can be monitored. 
Execution Status The JTAG debug port can monitor processor execution status to determine 
whether the processor is stopped, waiting, or running. 


Exception Status The JTAG debug port can monitor the status of pending synchronous 
exceptions. 


Most Recent Reset The JTAG debug port or an mfspr instruction can be used to read the Debug 
Status Register (DBSR) to determine the type of the most recent reset. 


8.5 Debug Registers 


Several debug registers, available to debug tools running on the processor, are not intended for use 
by application code. Debug tools control debug resources such as debug events. Application code 
that uses debug resources can cause the debug tools to fail, as well as other unexpected results, 
such as program hangs and processor resets. 


Application code should not use the debug resources, including the debug registers. 


8.5.1 Debug Control Registers 


The debug control registers (DBCRO and DBCR1) can enable and configure debug events, reset the 
processor, control timer operation during debug events, enable debug interrupts, and set the 
processor debug mode. 


8.5.1.1 Debug Control Register 0 (DBCRO) 


EDM RST BT TDE IA2 IA12X_ IA4_ IA34X_ IA34T 


bs el el 


2 3/4/5/6 8) 9/10) 11)12)13)14/ 15/16/17) 18 30] 31 
IDM IC ha I IA12 IA3 1A34_ IA12T FT 
Figure 8-1. Debug Control Register 0 (DBCRO) 
0 EDM External Debug Mode 
0 Disabled 
1 Enabled 
1 IDM Internal Debug Mode 
0 Disabled 
1 Enabled 
2:3 RST Reset Causes a processor reset request when 
00 No action set by software. 
01 Core reset 
10 Chip reset 
11 System reset 
Attention: Writing 01, 10, or 11 to this field causes a processor reset request. 
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Instruction Completion Debug Event 
0 Disabled 
1 Enabled 


BT 


Branch Taken Debug Event 
0 Disabled 
1 Enabled 


EDE 


Exception Debug Event 
0 Disabled 
1 Enabled 


TDE 


Trap Debug Event 
0 Disabled 
1 Enabled 


1A1 


IAC 1 Debug Event 
0 Disabled 
1 Enabled 


lA2 


IAC 2 Debug Event 
0 Disabled 
1 Enabled 


IA12 


Instruction Address Range Compare 1-2 
0 Disabled 
1 Enabled 


Registers IAC1 and IAC2 define an 
address range used for IAC address 
comparisons. 


IA12X 


Enable Instruction Address Exclusive 
Range Compare 1-2 

0 Inclusive 

1 Exclusive 


Selects the range defined by IAC1 and 
IAC2 to be inclusive or exclusive. 


IA3 


IAC 3 Debug Event 
0 Disabled 
1 Enabled 


IA4 


IAC 4 Debug Event 
0 Disabled 
1 Enabled 


IA34 


Instruction Address Range Compare 3-4 
0 Disabled 
1 Enabled 


Registers IAC3 and IAC4 define an 
address range used for IAC address 
comparisons. 


IA34X 


Instruction Address Exclusive Range 
Compare 3-4 

0 Inclusive 

1 Exclusive 


Selects range defined by IAC3 and IAC4 to 
be inclusive or exclusive. 


IA12T 


Instruction Address Range Compare 1-2 
Toggle 

0 Disabled 

1 Enable 


Toggles range 12 inclusive, exclusive 
DBCR[IA12X] on debug event. 


IA34T 


Instruction Address Range Compare 3-4 
Toggle 

0 Disabled 

1 Enable 


Toggles range 34 inclusive, exclusive 
DBCR[IA34X] on debug event. 


18:30 


Reserved 
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31 


FT 


Freeze timers on debug event 
0 Timers not frozen 
1 Timers frozen 


8.5.1.2 Debug Control Register! (DBCR1) 


DIR DiW DIS DA12 DV1M DV1BE 
0)1/2/3)4 5/6 7)8/9/10 11/12 13/14 15/16 19/20 23) 24 31 
D2R D2Ww D2S DA12X DV2M DV2BE 
Figure 8-2. Debug Control Register 1 (DBCR1) 
0 DIR DAC1 Read Debug Event 
0 Disabled 
1 Enabled 
1 D2R DAC 2 Read Debug Event 
0 Disabled 
1 Enabled 
2 D1W DAC 1 Write Debug Event 
0 Disabled 
1 Enabled 
3 D2W DAC 2 Write Debug Event 
0 Disabled 
1 Enabled 
4:5 D1S DAC 1 Size Address bits used in the compare: 
00 Compare all bits 
01 Ignore Isb (least significant bit) Byte address 
10 Ignore two Isbs Halfword address 
11 Ignore five Isbs Word address 
Cache line (8-word) address 
6:7 D2S DAC 2 Size Address bits used in the compare: 
00 Compare all bits 
01 Ignore Isb (least significant bit) Byte address 
10 Ignore two Isbs Halfword address 
11 Ignore five Isbs Word address 
Cache line (8-word) address 
8 DA12 Enable Data Address Range Compare 1:2. Registers DAC1 and DAC2 define an 
0 Disabled address range used for DAC address 
1 Enabled comparisons 
AS) DA12X | Data Address Exclusive Range Compare Selects range defined by DAC1 and DAC2 
1:2 to be inclusive or exclusive 
0 Inclusive 
1 Exclusive 
10:11 Reserved 
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12:13 | DV1IM Data Value Compare 1 Mode Type of data comparison used: 
00 Undefined 
01 AND All bytes selected by DBCR1[DV1BE] must 
compare to the appropriate bytes of DVC1. 
10 OR One of the bytes selected by 
DBCR1[DV1BE] must compare to the 
appropriate bytes of DVC1. 
11 AND-OR The upper halfword or lower halfword must 
compare to the appropriate halfword in 
DVC1. When performing halfword 
compares set DBCR1[DV1BE] = 0011, 
1100, or 1111. 
14:15 | DV2M Data Value Compare 2 Mode Type of data comparison used 
00 Undefined 
01 AND All bytes selected by DBCR1[DV2BE] must 
compare to the appropriate bytes of DVC2. 
10 OR One of the bytes selected by 
DBCR1[DV2BE] must compare to the 
appropriate bytes of DVC2. 
11 AND-OR The upper halfword or lower halfword must 
compare to the appropriate halfword in 
DVC2. When performing halfword 
compares set DBCR1[DV2BE] = 0011, 
1100, or 1111. 
16:19 | DV1BE | Data Value Compare 1 Byte Selects which data bytes to use in data 
0 Disabled value comparison 
1 Enabled 
20:23 | DV2BE | Data Value Compare 2 Byte Selects which data bytes to use in data 
0 Disabled value comparison 
1 Enabled 
24:31 Reserved 


8.5.2 Debug Status Register (DBSR) 


The DBSR contains status on debug events and the most recent reset; the status is obtained by 
reading the DBSR. The status bits are normally set by debug events or by any of the three reset 


types. 


Clearing DBSR fields is performed by writing a word to the DBSR, using the mtdbsr extended 
mnemonic, having a 1 in all bit positions to be cleared and a 0 in the all other bit positions. The data 
written to the DBSR is not direct data, but a mask. A 1 clears the bit and a 0 has no effect. 


Application code should not use the DBSR. 
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IC EDE UDE IA2 DW1 DW2 _sIA3 MRR 


; 


yy 4 
4/5/6|7|8 


10) 11/12) 13) 14 21) 22 23)24 


31 


a 


TIE IA1 


9 
1 DR2 IDE lA4 


3/4/5]6] 7 
Lid 


Figure 8-3. Debug Status Register (DBSR) 


IC Instruction Completion Debug Event 
0 Event did not occur 
1 Event occurred 


BT Branch Taken Debug Event 
0 Event did not occur 
1 Event occurred 


EDE Exception Debug Event 
0 Event did not occur 
1 Event occurred 


TIE Trap Instruction Debug Event 
0 Event did not occur 
1 Event occurred 


UDE Unconditional Debug Event 
0 Event did not occur 
1 Event occurred 


IA1 IAC1 Debug Event 
0 Event did not occur 
1 Event occurred 


IA2 IAC2 Debug Event 
0 Event did not occur 
1 Event occurred 


DR1 DAC1 Read Debug Event 
0 Event did not occur 
1 Event occurred 


DW1 DAC1 Write Debug Event 
0 Event did not occur 
1 Event occurred 


DR2 DAC2 Read Debug Event 
0 Event did not occur 
1 Event occurred 


DW2 | DAC2 Write Debug Event 
0 Event did not occur 
1 Event occurred 


IDE Imprecise Debug Event 

0 No circumstance that would cause a 
debug event (if MSR[DE] = 1) occurred 

1 A debug event would have occurred, but 
debug exceptions were disabled 
(MSR[DE] = 0) 
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12 IA3 IAC3 Debug Event 

0 Event did not occur 
1 Event occurred 

13 IA4 IAC4 Debug Event 


0 Event did not occur 
1 Event occurred 


14:21 Reserved 
22:23 | MRR_ | Most Recent Reset This field is set to a value, indicating the 
00 No reset has occurred since last type of reset, when a reset occurs. 


cleared by software. 
01 Core reset 
10 Chip reset 
11 System reset 


24:31 Reserved 


8.5.3 Instruction Address Compare Registers (I[AC1-IAC4) 


The PPC405 can take a debug event upon an attempt to execute an instruction from an address. The 
address, which must be word-aligned, is defined in an IAC register. The DBCRO[IA1, IA2] fields of 
DBCRO controls the instruction address compare (IAC) debug event. 


0 29/30 31 


Figure 8-4. Instruction Address Compare Registers (IAC1-IAC4) 


0:29 Instruction Address Compare word Omit two low-order bits of complete 
address address. 
30:31 Reserved 


8.5.4 Data Address Compare Registers (DAC1—DAC2) 


The PPC405 can take a debug event upon storage or cache references to addresses specified in the 
DAC registers. The specified addresses in the DAC registers are EAs of operands of storage 
references or cache instructions. The fields DBCR1[D1R], [D2R] and DBCR[D1W}], [D2W] control the 
DAC-read and DAC-write debug events, respectively. 


Addresses in the DAC registers specify exact byte EAs for DAC debug events. However, one may 
want to take a debug event on any byte within a halfword (ignore the least significant bit (LSb) of the 
DAC), on any byte within a word (ignore the two LSbs of DAC), or on any byte within eight words 
(ignore four LSbs of DAC). DBCR1[D1S, D2S] control the addressing options. 


Errors related to execution of storage reference or cache instructions prevent DAC debug events. 
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Figure 8-5. Data Address Compare Registers (DAC1—DAC2) 


0:31 Data Address Compare (DAC) byte DBCRO[D1S] determines which address 
address bits are examined. 


8.5.5 Data Value Compare Registers (DVC1—DVC2) 


The PPC405 can take a debug event upon storage or cache references to addresses specified in the 
DAC registers, that also require the data at that address to match the value specified in the DVC 
registers. The data address compare for a DVC events works the same as for a DAC event. Cache 
operations do not cause DVC events. If the data at the address specified matches the value in the 
corresponding DVC register a DVC event will occur. The fields DBCR1[DV1M, DV2M] control how the 
data value are compared. 


Errors related to execution of storage reference or cache instructions prevent DVC debug events. 


Figure 8-6. Data Value Compare Registers (DVC1—DVC2) 
0:31 Data Value to Compare 


8.5.6 Debug Events 


Debug events, enabled and configured by DBCRO and DBCR1 and recorded in the DBSR, cause 
debug operations. A debug event occurs when an event listed in Table 8-1 on page 8-11 is detected. 
The debug operation is performed after the debug event. 


In internal debug mode, the processor generates a debug interrupt when a debug event occurs. In 
external debug mode, the processor stops when a debug event occurs. When internal and external 
debug mode are both enabled, the processor stops on a debug event with the debug interrupt 
pending. When external and internal debug mode are both disabled, and debug wait mode is enabled 
the processor stops, but can be restarted by an interrupt. When all debug modes are disabled, debug 
events are recorded in the DBSR, but no action is taken. 
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Table 8-1 lists the debug events and the related fields in DBCRO, DBCR1, and DBSR. DBCRO and 
DBCR1 enable the debugs events, and the DBSR fields report their occurrence. 


Table 8-1. Debug Events 


Enabling 
DBCRO, DBCR1 Reporting 
Event Fields DBSR Fields Description 

Instruction Completion | IC IC Occurs after completion of an instruction. 

Branch Taken BT BT Occurs before execution of a branch 
instruction determined to be taken. 

Exception Taken EDE EXC Occurs after an exception. 

Trap Instruction TDE TIE Occurs before execution of a trap 
instruction where the conditions are such 
that the trap will occur. 

Unconditional UDE UDE Occurs immediately upon being set by the 
JTAG debug port or the 
XXX_cpuUncondDebugEvent signal. 

Instruction Address IA1, IA2, IA3, IA1, IA2, IA3, Occurs before execution of an instruction 

Compare 1A4, 1A12, 1A4 at an address that matches an address 

IA12X, IA12T, defined by the Instruction Address 
1A34, IA34X, Compare Registers (IAC1—IAC4). 
IA34T 
Data Address D1R, D1W,D1S, | DR2,DW2 Occurs before execution of an instruction 
Compare D2R, D2W, D2s, that accesses a data address that matches 
DA12, DA12X the contents of the specified DAC register. 
Data Value Compare DV1M, DV2M, DR1, DW1 Occurs after execution of an instruction 
DV1BE, DV2BE that accesses a data address for which a 
DAC occurs, and for which the value at the 
address matches the value in the specified 
DVC register. 

Imprecise IDE Indicates that another debug event 

occurred while MSR[DE] = 0 
8.5.7 Instruction Complete Debug Event 


This debug event occurs after the completion of an instruction. If DBCRO[IDM] = 1, DBCRO[EDM] = 0 
and MSR[DE] =0 this debug event is disabled. 


8.5.8 Branch Taken Debug Event 


This debug event occurs before execution of a branch instruction determined to be taken. If 
DBCRO[IDM] = 1, DBCRO[EDM] = 0 and MSR[DE] =0 this debug event is disabled. 


8.5.9 Exception Taken Debug Event 


This debug event occurs after an exception. Exception debug events always include the non-critical 
class of exceptions. When DBCRO[IDM] = 1 and DBCRO[EDM] = 0 the critical exceptions are not 


included. 
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8.5.10 Trap Taken Debug Event 


This debug event occurs before execution of a trap instruction where the conditions are such that the 
trap will occur. When trap is enabled for a debug event, external debug mode is enabled, internal 
debug mode is enabled with MSR[DE] enabled, or debug wait mode is enabled, a trap instruction will 
not cause a program exception. 


8.5.11 Unconditional Debug Event 


This debug event occurs immediately upon being set by the JTAG debug port or the 
XXX_cpuUncondDebugEvent signal. 


8.5.12 IAC Debug Event 


This debug event occurs before execution of an instruction at an address that matches an address 
defined by the Instruction Address Compare Registers (IAC1—IAC4). DBCRO[IA1, IA2, IA3, 1A4] 
enable IAC debug events IAC can be defined as an exact address comparison to one of the I[ACn 
registers or on a range of addresses to compare defined by a pair of [ACn registers. 


8.5.12.1 IAC Exact Address Compare 


In this mode each IACn register specifies an exact address to compare. These are enabled by setting 
DBCRO[IAn] = 1 and disabling IAC range compare (DBCRO[IA1 2X] = 0 for IAC1 and IAC2 and 
DBCRO[IA23X] = 0 for IAC3 and IAC4). The corresponding DBSR{IAn] bit displays the results of the 
debug event. 


8.5.12.2 IAC Range Address Compare 
In this mode a pair of IACn registers are used to define a range of addresses to compare: 


Range 1:2 corresponds to IAC1 and IAC2 
Range 3:4 corresponds to IAC3 and IAC4 


To enable Range 1:2, DBCRO[IA12] = 1 and DBCRO[IA1] or DBCRO[IA2] =1. An IAC event will be 
seen on the DBSR[IAn] field that corresponds to the enabled DBCRO[IAn] field. If DBCRO[IA1] and 
DBCRO[IA2] are enabled, the results of the event are reported on both DBSR fields. Setting 
DBCRO[IA12] =1 prohibits IAC1 and IAC2 from being used for exact address compares. 


To enable Range 3:4, DBCRO[IA34] = 1 and DBCRO[IA3] or DBCRO[IA4] =1. An IAC event will be 
seen on the DBSR|IAn] field that corresponds to the enabled DBCRO[IAn] field. If DBCRO[IA3] and 
DBCRO[IA4] are enabled, the results of the event will be reported on both DBSR fields. Setting 
DBCRO[IA34] =1 prohibits IAC3 and IAC4 from being used for exact address compares. 


Ranges can be defined as inclusive, as shown in the preceding examples, or exclusive, using 
DBCRO[IA12X] (corresponding to range 1:2) and DBCRO[IA34X] (corresponding to range 3:4), as 
follows: 


DBCRO[IA12] = 1: Range 1:2 = IAC1 < range < IAC2. 
DBCRO[IA12X] = 1: Range 1:2 = Range low < IAC1 or IAC2 < Range high 
DBCRO[IA34] = 1: Range 3:4 = IAC3 < range < IAC4. 
DBCRO[IA34X] = 1: Range 3:4 = Range low < IAC3 or IAC4 < Range high 
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Figure 8-7 shows the range selected in an inclusive IAC range address compare. Note that the 
address in IAC1 is considered part of the range, but the address in IAC2 is not, as shown in the 
preceding examples. The thick lines indicate that the indicated address is included in the compare 
results. 
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Figure 8-7. Inclusive IAC Range Address Compares 


Figure 8-8 shows the range selected in an inclusive IAC range address compare. Note that the 
address in IAC1 is not considered part of the range, but the address in IAC2 is, along with the highest 
memory address, as shown in the preceding examples. 
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Figure 8-8. Exclusive IAC Range Address Compares 


To toggle the range from inclusive to exclusive or from exclusive to inclusive on a IAC range debug 
event, DBCRO[IA12T] (corresponding to range 1:2) and DBCRO[IA34T] (corresponding to range 3:4) 
are used. If these fields are set, the DBCRO[IA12X] or DBCRO[IA34X] fields toggle on an IAC debug 
event, changing the defined range. 


When a toggle is enabled (DBCRO[IA12T] for range 1:2 or DBCRO[IA34T] = 1 for range 3:4), and 
DBCRO[IDM] =1, DBCRO[EDN] = 0, and MSR[DE] = 0, IAC range comparisons for the corresponding 
toggle field are disabled. 


8.5.13 DAC Debug Event 


This debug event occurs before execution of an instruction that accesses a data address that 
matches the contents of the specified DAC register. DBCR1[D1R, D2R, D1W, D2W] enable DAC 
debug events for address comparisons on DAC1 and DAC2 for read instructions, DAC2 for read 
instructions, DAC1 for write instructions, DAC2 for write instructions respectively. Loads are reads and 
stores are writes. DAC can be defined(DBCR1[D1R, D2R])as an exact address comparison to one of 
the DACn registers or a range of addresses to compare defined by DAC1 and DAC2 registers. 


8.5.13.1 DAC Exact Address Compare 


In this mode, each DACn register specifies an exact address to compare. Thes registers are enabled 
by setting one or more of DBCR1[D1R,D2R,D1W,D2W] = 1, and disabling DAC range compare 
DBCR1[DA12X] = 0. The corresponding DBSR[DR1,DR2,DW1 ,DW2] field displays the results of a 
DAC debug event. 
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The address for a DAC is the effective address (EA) of a storage reference instruction. EAs are 
always generated within a single aligned word of memory. Unaligned load and store, strings, and 
multiples generate multiple EAs to be used in DAC comparisons. 


Data address compare (DAC) debug events can be set to react to any byte in a larger block of 
memory, in addition to reacting to a byte address match. The DAC Compare Size fields (DBCR1[D1S, 
D2S]) allow DAC debug events to react to byte, halfword, word, or 8-word line address by ignoring a 
number of LSBs in the EA. 


DAC 1 Size 

00 Compare all bits Byte address 

01 Ignore LSB (least significant bit) Halfword address 

10 Ignore two LSBs Word address 

11 Ignore five LSBs Cache line (8-word) address 


The user must determine how the addresses of interest are accessed, relative to byte, halfword, 
word, string, and unaligned storage instructions, and adjust the DAC compare size field appropriately 
to cover the addresses of interest. 


For example, suppose that a DAC debug event should react to byte 3 of a word-aligned target. A DAC 
set for exact compare would not recognize a reference to that byte by load/store word or load/store 
halfword instructions, because the byte address is not the EA of such instructions. In such a case, the 
D1S field must be set for a wider capture range (for example, to ignore the two least significant bits 
(LSBs) if word operations to the misaligned byte are to be detected). The wider capture range may 
result in excess debug events (events that are within the specified capture range, but reflect byte 
operations in addition to the desired byte). Such excess debug events must be handled by software. 


While load/store string instructions are inherently byte addressed the processor will generate EAs 
containing the largest portion of an aligned word address as possible. It may not be possible to DAC 
on a specific individual byte using load/store string instructions. 


8.5.13.2 DAC Range Address Compare 


In this mode, the pair of DAC1 and DAC2 registers are used to define a range of addresses to 
compare. 


To enable DAC range, DBCR1[DA12] = 1 and one or more of DBCR1[D1R,D2R,D1W,D2W] =1. The 
DAC event is seen on the DBSR[DR1,DR2,DW1 ,DW2] field that corresponds to the 
DBCR1[D1R,D2R,D1W,D2W] field that is enabled. For example, if DBCR1[D1R] and DBCR1[D2R] 
are enabled, the results of a DAC debug event are reported on DBSR[DR1, DR2]. Setting 
DBCR1[DA12] =1 prohibits DAC1 and DAC2 from being used for exact address compares. 


Ranges are defined to be inclusive or exclusive, using the DBCR1[DA12X], as follows: 


DBCR1[DA12] = 1: Range = DAC1 < range < DAC2. 
DBCR1[DA12X] = 1: Range = Range low < DAC1 or DAC2 < Range high. 


Figure 8-9 shows the range selected in an inclusive DAC range address compare. Note that the 
address in DAC1 is considered part of the range, but the address in DAC2 is not, as shown in the 


8-14 PPC405 Core User’s Manual 


preceding examples. The thick lines indicate that the indicated address is included in the compare 
results. 
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Figure 8-9. Inclusive DAC Range Address Compares 


Figure 8-10 shows the range selected in an exclusive DAC range address compare. Note that the 
address in DAC1 is not considered part of the range, but the address in DAC2 is, along with the 
highest memory address, as shown in the preceding examples. 
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Figure 8-10. Exclusive DAC Range Address Compares 


The DAC Compare Size fields (DBCR1[D1S, D2S]) are not used by DAC range comparisons. 


8.5.13.3 DAC Applied to Cache Instructions 
Some cache instructions can cause DAC debug events. There are several special cases. 
Table 8-2 summarizes possible DAC debug events by cache instruction: 


Table 8-2. DAC Applied to Cache Instructions 


Possible DAC Debug Event 
Instruction DAC-Read DAC-Write 
dcba No Yes 
dcbf No Yes 
debi No Yes 
dcbst No Yes 
dcbt Yes No 
dcbz No Yes 
dccci No No 
dcread No No 
dcbtst Yes No 
icbi Yes No 
icbt Yes No 
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Table 8-2. DAC Applied to Cache Instructions (continued) 


Possible DAC Debug Event 


Instruction DAC-Read DAC-Write 
iccci No No 
icread No No 


Architecturally, the dcbi and dcbz instructions are “stores.” These instructions can change data, or 
cause the loss of data by invalidating a dirty line. Therefore, they can cause DAC-write debug events. 


The dccci instruction can also be considered a “store” because it can change data by invalidating a 
dirty line. However, dccci is not address-specific; it affects an entire congruence class regardless of 
the operand address of the instruction. Because it is not address-specific, decci does not cause 
DAC-write debug events. 


Architecturally, the dcbt, dcbtst, dcbf, and dcbst instructions are “loads.” These instructions do not 
change data. Flushing or storing a cache line from the cache is not architecturally a “store” because a 
store had already updated the cache; the dcbf or dcbst instruction only updates the copy in main 
memory. 


The debt and debtst instructions can cause DAC-read debug events regardless of cachability. 


Although debf and debst are architecturally “loads,” these instructions can create DAC-write (but not 
DAC-read) debug events. In a debug environment, the fact that external memory is being written is 
the event of interest. 


Even though dcread and dccci are not address-specific (they affect a congruence class regardless of 
the instruction operand address), and are considered “loads,” in the PPC405 they do not cause DAC 
debug events. 


All ICU operations (icbi, icbt, iccci, and icread) are architecturally treated as “loads.” icbi and icbt 
cause DAC debug events. iccci and icread do not cause DAC debug events in the PPC405. 


8.5.13.4 DAC Applied to String Instructions 


An stswx instruction with a string length of 0 is a no-op. The Iswx instruction with the string length 
equal to 0 does not alter the RT operand with undefined data, as allowed by the PowerPC 
Architecture. Neither stswx nor Iswx with zero length causes a DAC debug event because storage is 
not accessed by these instructions. 


8.5.14 Data Value Compare Debug Event 


A data value compare (DVC) debug event can occur only after execution of a load or store instruction 
to an address that compares with the address in one of the DACn registers and has a data value that 
matches the corresponding DVCn register. Therefore, a DVC debug event requires both the data 
address comparison and the data value comparison to be true. A DVCn debug event when enabled 
in the DBCR1 supercedes a DACn debug event since the DVCn and the DACn both use the same 
DACn register. 


DVC1 debug events are enabled by setting the appropriate DAC enable DBCR1[D1R,D1W] to cause 
an address comparison and by setting anybit combination in the DBCR1[DV1BE]. DVC2 debug 
events are enabled by setting the appropriate DAC enable DBCR1[D2R,D2W] to cause an address 
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comparison and by setting any bit combination in the DBCR1[DV1BE]. Each bit in DBCR1[DV1BE, 
DV2BE] correspondes to a byte in DVC1 and DVC2. Exact address compare and range address 
compare work the same for DVC as for a simple DAC. 


DBSR[DR1] and DBSR[DW1] record status for DAC1 debug events. Which DBSR bit is set depends 
on the setting of DBCR1[D1R] and DBCR[D1W/J. If DBCR1[D1R] = 1, DBSR[DR1] = 1, assuming that 
a DVC event occurred. Similarly, if DBCR1[D1W] = 1, DBSR[DW1] = 1, assuming that a DVC event 
occurred. 


Similarly, DBSR[DR2] and DBSR[DW2] record status for DAC2 debug events. Which DBSR bit is set 
depends on the setting of DBCR1[D2R] and DBCR[D2W]. If DBCR1[D2R] = 1, DBSR[DR2] = 1, 
assuming that a DVC event occurred. Similarly, if DBCR1[D2W] = 1, DBSR[DW2] = 1, assuming that 
a DVC event occurred. 


In the following example, a DVC1 event is enabled by setting DBCR1[D1R] = 1, DBCR1[D1W] = 1, 
DBCR1[DA12] = 0, and DBCR1[DV1BE] = 0000. When the data address and data value match the 
DAC1 and DVC1, a DVC1 event is recorded in DBSR[DR1] or DBSR[DW1], depending on whether 
the operation is a load (read) or a store (write). This example corresponds to the last line of Table 8-3. 


In Table 8-3, nis 1 or 2, depending on whether the bits apply to DAC1, DAC2, DVC1, and DVC2 
events. “Hold” indicates that the DBSR holds its value unless cleared by software. “RA” indicates that 
the operation is a read (load) and the data address compares (exact or range). “WA” indicates that the 
operation is a write (store) and the data address compares (exact or range). “RV” indicates that the 
operation is a read (load), the data address compares (exact or range), and the data value compares 
according to DBCR1[DVCr]. 


Table 8-3. Setting of DBSR Bits for DAC and DVC Events 


DBCR1 DBSR 
DACn Event | DVCn Enabled | DVCn Event | [DnR] [DnW] | [DA12] | [DRn] [DWn] 
0 — = = _ — Hold Hold 
— —_ — 0 0 — Hold Hold 
1 0 _ 0 1 _ Hold WA 
1 0 — 1 0 — RA Hold 
1 0 = 1 1 — RA WA 
1 1 0 = — — Hold Hold 
1 1 1 0 1 — Hold WV 
1 1 1 1 0 _ RV Hold 
1 1 1 1 1 — RV WV 


The settings of DBCR1[DV1M] and DBCR1[DV2M] are more precisely defined in Table 8-5 and 
Table 8-6. (n enables the table to apply to DBCR1[DV1M, DV2M] and DBCR1[DV1BE, DV2BE)). 
DVnBE,, indicates bytes selected (or not selected) for comparison in DBCR1[DVnBE]. 


When DBCR1[DVn\M] = 01, the comparison is an AND; all bytes must compare to the appropriate 
bytes of DVC1. 


When DBCR1[DVnM] = 10, the comparison is an OR; at least one of the selected bytes must 
compare to the appropriate bytes of DVC1. 
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When DBCR1[DVnM] = 11, the comparison is an AND-OR (halfword) comparison. This is intended 
for use when DBCR1[DVnBE] is set to 0011, 0111, or 1111. Other values of DBCR1[DVnBE] can be 
compared, but the results are more easily understood using the AND and OR comparisons. In 
Table 8-4, “not” is —=, AND is a, and OR is v. 


Table 8-4. Comparisons Based on DBCR1[DVnM] 


DBCR1[DVnN] Setting | Operation Comparison 

00 — Undefined 

01 AND (=DV nBEg v (DVC1[byte 0] = data[byte 0])) ~ 
(=DVnBE, v (DVCi[byte 1] = data[byte 1])) ~ 
(=DVnBE» v (DVCi[byte 2] = data[byte 2])) ~ 
(=DV nBE3 v (DVC1[byte 3] = data[byte 3])) 

10 OR (DVnBEg A (DVC1[byte 0] = data[byte 0])) v 
(DVnBE, A (DVC1[byte 1] = data[byte 1])) v 
(DVnBE» «A (DVC1[byte 2] = data[byte 2])) v 
(DVnBE3 A (DVC1[byte 3] = data[byte 3])) 

11 AND-OR (DVnBEg A (DVC1[byte 0] = data[byte 0])) ~ 
(DVnBE, A (DVC1[byte 1] = data[byte 1])) v 
(DVnBE» A (DVC1[byte 2] = data[byte 2])) ~ 
(DVnBE3 A (DVC1[byte 3] = data[byte 1])) 


Table 8-5 illustrates comparisons for aligned DVC accesses, that is, words, halfwords, or bytes on 
naturally aligned boundaries (all byte accesses are aligned). 


Table 8-5. Comparisons for Aligned DVC Accesses 


| Access DBCR1[DVnBE] Setting Value Operation 


Halfword value replicated | AND-OR 


Halfword (High-Order) Halfword value replicated | AND-OR 


Byte All Byte value replicated OR 


For halfword accesses, the halfword value is replicated in the “empty “ halfword in the DVC register, 
for example, if the low-order halfword is to be compared, its value is stored in the low-order halfword 
and the high-order halfword of the register. Similarly, a byte value is replicated in each byte in the 
register. 
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Table 8-6 illustrates comparisons for misaligned DVC accesses. In the “DVC1” and “DVC2” columns, 
“x” indicates a don’t care. 


Table 8-6. Comparisons for Misaligned DVC Accesses 


DBCR1[DV1BE] | DBCR1[DV2BE] | DBCR1[D2S] 
Operation | DVC1 (Hex) | DVC2 (Hex) Setting Setting Setting 
ND 


Word A XX112233 44xx XXXX 123 0 
(Offset 1) 
Word AND XXXX 1122 3344 xxxx 01 
(Offset 2) 
Word AND XXXXXX11 2233 44xx 
(Offset 3) 

AND 


Halfword xx1122xx 12 12 10 
(Offset 1) 
Halfword AND XXXXXX11 22XX XXXX 3 0 10 
(Offset 3) 


Note: Misaligned accesses stop the processor on the instruction causing the compare hit. The 
second part of an instruction is not performed if the first part of the compare hits. 


8.5.15 Imprecise Debug Event 


The imprecise debug event is not an independent debug event, but indicates that a debug event 
occurred while MSR[DE] = 0. This is useful in internal debug mode if a debug event occurs while in a 
critical interrupt handler. On return from interrupt, a debug interrupt occurs if MSR[DE] = 1. If 
DBSRI[IDE] = 1, the debug event causing the interrupt occurred sometime earlier, not immediately 
after a debug event. 


8.6 Debug Interface 


The PPC405 core provides a and trace interfaces to support hardware and software test and debug. 
Typically, the JTAG interface connects to a debug port external to the PPC405; the debug port is 
typically connected to a JTAG connector on a processor board. 


The trace interface connects to a trace port, also external to the PPC405, that is typically connected 
to a trace connector on the processor board. 
8.6.1 IEEE 1149.1 Test Access Port (JTAG Debug Port) 


The IEEE 1149.1 Test Access Port (TAP), commonly called the JTAG (Joint Test Action Group) debug 
port, is an architectural standard described in IEEE Std 1149.1-1990, /EEE Standard Test Access 
Port and Boundary Scan Architecture. The standard describes a method for accessing internal chip 
facilities using a four- or five-signal interface. 


The JTAG debug port, originally designed to support scan-based board testing, is enhanced to 
support the attachment of debug tools. The enhancements, which comply with the IEEE 1149.1 
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specifications for vendor-specific extensions, are compatible with standard JTAG hardware for 
boundary-scan system testing. 


JTAG Signals The JTAG debug port implements the four required JTAG signals: TCK, 
TMS, TDI, and TDO, and the optional TRST signal. 

JTAG Clock The frequency of the TCK signal can range from DC to one-half of the 

Requirements internal chip clock frequency. 

JTAG Reset The JTAG debug port logic is reset at the same time as a system reset. 

Requirements Upon receiving TRST, the JTAG TAP controller returns to the Test-Logic 


Reset state. 


8.7 JTAG Connector 


A 16-pin male 2x8 header connector is suggested as the JTAG debug port connector. This connector 
definition matches the requirements of the RISCWatch debugger from IBM. The connector is shown 
in Figure 8-11 and the signals are shown in Table 8-7. The connector should be placed as close as 
possible to the chip to ensure signal integrity. 


Note that position 14 does not contain a pin. 


1 


XN ewKeR RK RK BQ 


Figure 8-11. JTAG Connector Physical Layout (Top View) 


Table 8-7. JTAG Connector Signals 


Description 
JTAG Test Data Out 
No connect (NC) | Reserved 
TDI! JTAG Test Data In 
TRST JTAG Reset 


Reserved 


Processor Power OK 
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Table 8-7. JTAG Connector Signals (continued) 


Description 


JTAG Test Mode Select 


Reserved 


Processor Halt 


Reserved 


Reserved 


NC 


1. A 10K ohm pullup resistor should be connected to this signal to reduce chip power consumption. 
The pullup resistor is not required. 


2. The +POWER signal, sourced from the target development board, indicates whether the processor 
is operating. This signal does not supply power to the RISCWatch hardware or to the processor. 
The active level on this signal can be +5V or +3.3V (note that the PPC405 core can have either 
+5V or +3.3V I/O, but the processor itself must be powered by +3.3V). A series resistor (1K ohm or 
less) should be used to provide short circuit current-limiting protection. 


3. A 10K ohm pullup resistor must be connected to these signals to ensure proper chip operation 
when these inputs are not used. 


8.7.1. JTAG Instructions 


The JTAG debug port provides the standard extest, idcode, sample/preload, and bypass instructions 
and the optional highz and clamp instructions. Invalid instructions behave as the bypass instruction. 


Table 8-8. JTAG Instructions 


Instruction Code Comments 
Extest 000 IEEE 1149.1 standard. 
Intest 1111001 | IEEE 1149.1 standard. 
Sample/Preload | 1111010 | IEEE 1149.1 standard. 
Private Xxxx100 | Private instructions 
Bypass 1111111 | IEEE 1149.1 standard. 


8.7.2 JTAG Boundary Scan 


Boundary Scan Description Language (BSDL), IEEE 1149.1b-1994, is a supplement to IEEE 
1149.1-1990 and IEEE 1149.1a-1993 Standard Test Access Port and Boundary-Scan Architecture. 
BSDL, a subset of the IEEE 1076-1993 Standard VHSIC Hardware Description Language (VHDL), 
allows a rigorous description of testability features in components which comply with the standard. 
BSDL is used by automated test pattern generation tools for package interconnect tests and by 
electronic design automation (EDA) tools for synthesized test logic and verification. BSDL supports 
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robust extensions that can be used for internal test generation and to write software for hardware 
debug and diagnostics. 


The primary components of BSDL include the logical port description, the physical pin map, the 
instruction set, and the boundary register description. 


The logical port description assigns symbolic names to the pins of a chip. Each pin has a logical type 
of in, out, inout, buffer, or linkage that defines the logical direction of signal flow. 


The physical pin map correlates the logical ports of the chip to the physical pins of a specific package. 
A BSDL description can have several physical pin maps; each map is given a unique name. 


Instruction set statements describe the bit patterns that must be shifted into the Instruction Register to 
place the chip in the various test modes defined by the standard. Instruction set statements also 
support descriptions of instructions that are unique to the chip. 


The boundary register description lists each cell or shift stage of the Boundary Register. Each cell has 
a unique number: the cell numbered 0 is the closest to the Test Data Out (TDO) pin; the cell with the 
highest number is closest to the Test Data In (TDI) pin. Each cell contains additional information, 
including: cell type, logical port associated with the cell, logical function of the cell, safe value, control 
cell number, disable value, and result value. 


8.8 Trace Port 


The PPC405 core implements a trace status interface to support the tracing of code running in real- 
time. This interface enables the connection of an external trace tool, such as RISCWatch, and allows 
for user-extended trace functions. A software tool with trace capability, such as RISCWatch with 
RISCTrace, can use the data collected from this port to trace code running on the processor. The 
result is a trace of the code executed, including code executed out of the instruction cache if it was 
enabled. Information on trace capabilities, how trace works, and how to connect the external trace 
tool is available in RISCWatch Debugger User's Guide. 
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Chapter 9. Instruction Set 


Descriptions of the PPC405 instructions follow. Each description contains the following elements: 


¢ Instruction names (mnemonic and full) 

¢ Instruction syntax 

¢ Instruction format diagram 

¢ Pseudocode description 

¢ Prose description 

¢ Registers altered 

¢ Architecture notes identifying the associated PowerPC Architecture component 


Where appropriate, instruction descriptions list invalid instruction forms and exceptions, and provide 
programming notes. 


9.1. Instruction Set Portability 


To support embedded real-time applications, the instruction sets of the PPC405 core and other IBM 
controllers implement the IBM PowerPC Embedded Environment, which is not part of the PowerPC 
Architecture defined in The PowerPC Architecture: A Specification for a New Family of RISC 
Processors. 


Programs using these instructions are not portable to PowerPC implementations that do not 
implement the IBM PowerPC Embedded Environment. 


The PPC405 core implements a number of implementation-specific instructions that are not part of 
the PowerPC Architecture or the IBM PowerPC Embedded Environment, which are listed in Table 9-1. 
In the table, the syntax “[o]” indicates that an instruction has an “o” form, which updates the 
XER[SO,OV] fields, and a “non-o” form. The syntax “[.]” indicates that an instruction has a “record” 
form, which updates CR[CRO], and a “non-record” form. 


Table 9-1. Implementation-Specific Instructions 


dccci macchw(o][.] mfdcr nmacchwl[o][.] | rfci 
dcread | macchwsf[o][.] | mtdcr nmacchws[o][.] | tlbre 
iccci macchwsu[o][.] | mulchw/[.] | nmachhwio][.] | tlbsx[.] 
icread macchwu[o][.] | mulchwu[.] | nmachhws[o][.] | tlbwe 
machhwh[o][.] mulhhw[.] | nmaclhw([o][.] wrtee 


machhwsf[o][.] | mulhhwu[.] | nmaclhwsj[o][.] | wrteei 
machhwsufo][.] | mullhw[.] 
machhwufo][.]_ | mullhwu[.] 
maclhw(o][.] 
maclhws[o][.] 
maclhwsu[o][.] 
maclhwu[o][.] 
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9.2 Instruction Formats 


For more detailed information about instruction formats, including a summary of instruction field 
usage and instruction format diagrams for the PPC405 core, see “Instruction Formats” on page 9-2. 


Instructions are four bytes long. Instruction addresses are always word-aligned. 


Instruction bits 0 through 5 always contain the primary opcode. Many instructions have an extended 
opcode in another field. The remaining instruction bits contain additional fields. All instruction fields 
belong to one of the following categories: 


* Defined 


These instructions contain values, such as opcodes, that cannot be altered. The instruction format 
diagrams specify the values of defined fields. 


¢ Variable 


These fields contain operands, such as general purpose register selectors and immediate values, 
that may vary from execution to execution. The instruction format diagrams specify the operands in 
variable fields. 


« Reserved 


Bits in a reserved field should be set to 0. In the instruction format diagrams, reserved fields are 
shaded. 


If any bit in a defined field does not contain the expected value, the instruction is illegal and an illegal 
instruction exception occurs. If any bit in a reserved field does not contain 0, the instruction form is 
invalid and its result is architecturally undefined. Unless otherwise noted, the execute all invalid 
instruction forms without causing an illegal instruction exception. 


9.3 Pseudocode 


The pseudocode that appears in the instruction descriptions provides a semi-formal language for 
describing instruction operations. 


The pseudocode uses the following notation: 


= Assignment 

A AND logical operator 
a NOT logical operator 
Vv OR logical operator 


Exclusive-OR (XOR) logical operator 
+ Twos complement addition 
- Twos complement subtraction, unary minus 
x Multiplication 
+ Division yielding a quotient 
% Remainder of an integer division; (83 % 32) = 1. 
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if...then...else... 


do 


Herein 


REG[FLD] 


REG[FLD, FLD _ 


REG[FLD:FLD] 
GPR(r) 
(GPR(r)) 
DCR(DCRN) 


SPR(SPRN) 
TBR(TBRN) 


GPRs 
(Rx) 
(RAO) 
Co:3 

"b 


Concatenation 

Equal, not equal relations 
Signed comparison relations 
Unsigned comparison relations 


Conditional execution; if condition then a else b, where a and b represent 
One or more pseudocode statements. Indenting indicates the ranges of a 
and b. If bis null, the else does not appear. 


Do loop. “to” and “by” clauses specify incrementing an iteration variable; 
“while” and “until” clauses specify terminating conditions. Indenting 
indicates the scope of a loop. 


Leave innermost do loop or do loop specified in a leave statement. 
A decimal number 

A hexadecimal number 

A binary number 

An instruction or register field 

A bit in a named instruction or register field 

A range of bits in a named instruction or register field 

A list of bits, by number or name, in a named instruction or register field 
A bit in a named register 

A range of bits in a named register 

A list of bits, by number or name, in a named register 

A field in a named register 

A list of fields in a named register 

A range of fields in a named register 

General Purpose Register (GPR) r, where 0 <r < 31. 

The contents of GPR r, where 0 <r< 31. 


A Device Control Register (DCR) specified by the DCRF field in an 
mfdcer or mtder instruction 


An SPR specified by the SPRF field in an mfspr or mtspr instruction 


A Time Base Register (TBR) specified by the TBRF field in an mftb 
instruction 


RA, RB, 

The contents of a GPR, where xis A, B, S, or T 

The contents of the register RA or 0, if the RA field is 0. 

A four-bit object used to store condition results in compare instructions. 
The bit or bit value bis replicated n times. 
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XX 
CEIL(x) 
EXTS(x) 
PC 
RESERVE 


CIA 


NIA 


MS(adar, n) 
EA 
EA, 


EAp:b 
ROTL((RS),n) 


MASK(MB,ME) 


instruction(EA) 


Bit positions which are don’t-cares. 

Least integer > x. 

The result of extending x on the left with sign bits. 
Program counter. 


Reserve bit; indicates whether a process has reserved a block of 
storage. 


Current instruction address; the 32-bit address of the instruction being 
described by a sequence of pseudocode. This address is used to set the 
next instruction address (NIA). Does not correspond to any architected 
register. 


Next instruction address; the 32-bit address of the next instruction to be 
executed. In pseudocode, a successful branch is indicated by assigning 
a value to NIA. For instructions that do not branch, the NIA is CIA +4. 


The number of bytes represented by n at the location in main storage 
represented by adar. 


Effective address; the 32-bit address, derived by applying indexing or 
indirect addressing rules to the specified operand, that specifies an 
location in main storage. 


A bit in an effective address. 
A range of bits in an effective address. 


Rotate left; the contents of RS are shifted left the number of bits 
specified by n. 

Mask having 1s in positions MB through ME (wrapping if MB > ME) and 
Os elsewhere. 


An instruction operating on a data or instruction cache block associated 
with an EA. 
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9.3.1 Operator Precedence 
Table 9-2 lists the pseudocode operators and their associativity in descending order of precedence: 


Table 9-2. Operator Precedence 


Operators Associativity 


REGp, REG[FLD], function Left to right 
evaluation 


"b Right to left 


—, — (unary minus) Right to left 


Left to right 


Left to right 


Left to right 


Left to right 


Left to right 


Left to right 


ee None 


9.4 Register Usage 


Each instruction description lists the registers altered by the instruction. Some register changes are 
explicitly detailed in the instruction description (for example, the target register of a load instruction). 
Other registers are changed, with the details of the change not included in the instruction description. 
This category frequently includes the Condition Register (CR) and the Fixed-point Exception Register 
(XER). For discussion of the CR, see “Condition Register (CR)” on page 2-10. For discussion of XER, 
see “Fixed Point Exception Register (XER)” on page 2-7. 


9.5 Alphabetical Instruction Listing 


The following pages list the instructions available in the PPC405 core in alphabetical order. 
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add 


Add 
add RT, RA, RB OE=0, Rc=0 
add. RT, RA, RB OE=0, Rc=1 
addo RT, RA, RB OE=1, Rc=0 
addo. RT, RA, RB OE=1, Re=1 
31 RT RB OE 266 Re 
0 6 ih 16 21 22 31 


(RT) < (RA) + (RB) 


The sum of the contents of register RA and the contents of register RB is placed into register RT. 


Registers Altered 


¢ RT 


: CR[CRO]_r, GT, EQ, SO if Rc contains 1 


* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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addc 


Add Carrying 


addc RT, RA, RB OE=0, Rc=0 
addc. RT, RA, RB OE=0, Rc=1 
addco RT, RA, RB OE=1, Rc=0 
addco. RT, RA, RB OE=1, Rc=1 
31 RT RB OE 10 Re 
0) 6 11 16 21 22 31 


(RT) < (RA) + (RB) 


if (RA) + (RB) £ 292-1 then 


XER[CA] < 1 


else 


XER[CA] <— 0 


The sum of the contents of register RA and register RB is placed into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the add operation. 


Registers Altered 


¢ RT 


* XER[CA] 
° CR[CRO], +. GT, EQ, SO if Rc contains 1 
* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 


adde 


Add Extended 


adde RT, RA, RB OE=0, Rc=0 
adde. RT, RA, RB OE=0, Rc=1 
addeo RT, RA, RB OE=1, Rc=0 
addeo. RT, RA, RB OE =1, Rc=1 
31 RT RB OE 138 Re 
0) 6 11 16 21 22 31 


(RT) < (RA) + (RB) + XER[CA] 
if (RA) + (RB) + XER[CA] & 292-1 then 


XER[CA] < 1 


else 


XER[CA] <— 0 


The sum of the contents of register RA, register RB, and XER[CA] is placed into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the add operation. 


Registers Altered 


- RT 
* XER[CA] 


° CR[CRO]_7, GT, EQ, SO if Rc contains 1 
* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


9-8 PPC405 Core User’s Manual 


addi 


RT, RA, IM 


addi 


Add Immediate 


14 


RT 


RA IM 


(RT) < (RA|O) + EXTS(IM) 


If the RA field is 0, the IM field, sign-extended to 32 bits, is placed into register RT. 


31 


If the RA field is nonzero, the sum of the contents of register RA and the contents of the IM field, sign- 
extended to 32 bits, is placed into register RT. 


Registers Altered 


¢ RT 


Programming Note 


To place an immediate, sign-extended value into the GPR specified by RT, set RA = 0. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-3. Extended Mnemonics for addi 


Mnemonic 


la 


Operands 


RT, D(RA) 


Function 


Load address (RA + 0); D is an offset from a base 
address that is assumed to be (RA). 
(RT) < (RA) + EXTS(D) 

Extended mnemonic for 

addi RT,RA,D 


Other Registers 
Altered 


RT, IM 


Load immediate. 

(RT) < EXTS(IM) 
Extended mnemonic for 
addi RT,0,IM 


subi 


RT, RA, IM 


Subtract EXTS(IM) from (RAO). 
Place result in RT. 

Extended mnemonic for 

addi RT,RA,—IM 


Instruction Set 


9-9 


addic 


Add Immediate Carrying 


addic RT, RA, IM 


12 RT RA 


(RT) < (RA) + EXTS(IM) 

if (RA) + EXTS(IM) $ 292-1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


31 


The sum of the contents of register RA and the contents of the IM field, sign-extended to 32 bits, is 


placed into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the add operation. 


Registers Altered 
« RT 
* XER[CA] 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-4. Extended Mnemonics for addic 


Mnemonic | Operands Function 


subic RT, RA, IM Subtract EXTS(IM) from (RA) 

Place result in RT; place carry-out in XER[CA]. 
Extended mnemonic for 
addic RT,RA,-IM 


Other Registers 
Altered 
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addic. RT, RA, IM 


addic. 


Add Immediate Carrying and Record 


13 RT RA 


(RT) < (RA) + EXTS(IM) 

if (RA) + EXTS(IM) $ 282-1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the contents of register RA and the contents of the IM field, sign-extended to 32 bits, is 


placed into register RT. 


31 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the add operation. 


Registers Altered 

¢ RT 

* XER[CA] 

* CRICRO].t, Gt, ca, so 


Programming Note 


addic. is one of three instructions that implicitly update CR[CRO] without having an RC field. The 


other instructions are andi. and andis.. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-5. Extended Mnemonics for addic. 


Mnemonic | Operands Function 


subic. RT, RA, IM | Subtract EXTS(IM) from (RA). 


Extended mnemonic for 
addic. RT,RA,—IM 


Place result in RT; place carry-out in XER[CA]. 


Other Registers 
Altered 


CR[CRO] 
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addis 


Add Immediate Shifted 


addis RT, RA, IM 


15 RT RA IM 


(RT) <— (RA|O) + (IM || 160) 


If the RA field is 0, the IM field is concatenated on its right with sixteen 0-bits and placed into register 
RT. 


If the RA field is nonzero, the contents of register RA are added to the contents of the extended IM 
field. The sum is stored into register RT. 


Registers Altered 
¢ RT 
Programming Note 


An addi instruction stores a sign-extended 16-bit value ina GPR. An addis instruction followed by an 
ori instruction stores an arbitrary 32-bit value in a GPR, as shown in the following example: 


addis RT, 0, high 16 bits of value 
ori RT, RT, low 16 bits of value 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-6. Extended Mnemonics for addis 


Other Registers 
Mnemonic | Operands Function Altered 


RT, IM Load immediate shifted. 
(RT) < (IM |] '°0) 

Extended mnemonic for 
lis addis RT,0,IM 


RT, RA, IM_ | Subtract (IM || 160) from (RA|O). 
Place result in RT. 

Extended mnemonic for 
subis addis RT,RA,—IM 
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addme 
Add to Minus One Extended 


addme RT, RA OE=0, Rc=0 
addme. RT, RA OE=0, Rc=1 
addmeo RT, RA OE=1, Rc=0 
addmeo. RT, RA OE =1, Rc=1 
31 RT RA OE 234 Re 
0) 6 11 16 21 22 31 


(RT) < (RA) + XER[CA] + (-1) 

if (RA) + XER[CA] + OxFFFF FFFF $ 292-1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the contents of register RA, XER[CA], and —1 is placed into register RT. 

XER[CA] is set to a value determined by the unsigned magnitude of the result of the add operation. 
Registers Altered 

¢ RT 

* XER[CA] 

° CR[CRO], +. GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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addze 
Add to Zero Extended 


addze RT, RA OE=0, Rc=0 
addze. RT, RA OE=0, Rc=1 
addzeo RT, RA OE=1, Rc=0 
addzeo. RT, RA OE=1, Rc=1 
31 RT RA OE Re 
0) 6 11 16 21 22 31 


(RT) < (RA) + XER[CA] 

if (RA) + XER[CA] $ 2°? —1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the contents of register RA and XER[CA] is placed into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the add operation. 


Registers Altered 

¢ RT 

* XER[CA] 

* CRI[CRO].t Gt, Ea, so if Re contains 1 
* XER[SO, OV] if OE contains 1 
Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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and 


AND 
and RA, RS, RB Rc=0 
and. RA, RS, RB Re=1 
31 RS RA RB 28 Re 
0 6 11 16 21 31 


(RA) <— (RS) A (RB) 


The contents of register RS are ANDed with the contents of register RB; the result is placed into 


register RA. 


Registers Altered 

° RA 

: CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 


andc 


AND with Complement 


andc RA,RS,RB Rc=0 
andc. RA,RS,RB Re=1 
31 RS RB Re 
0 6 11 16 21 31 
(RA) <— (RS) A -(RB) 


The contents of register RS are ANDed with the ones complement of the contents of register RB; the 


result is pl 


aced into register RA. 


Registers Altered 


« RA 


® CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architect 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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andi. 
AND Immediate 


andi. RA, RS, IM 


28 RS RA IM 


(RA) <— (RS) A (‘80 |] IM) 


The IM field is extended to 32 bits by concatenating 16 0-bits on its left. The contents of register RS is 
ANDed with the extended IM field; the result is placed into register RA. 


Registers Altered 

« RA 

* CRICRO]Lt, at, Ea, so 

Programming Note 

The andi. instruction can test whether any of the 16 least-significant bits in a GPR are 1-bits. 


andi. is one of three instructions that implicitly update CR[CRO] without having an Rc field. The other 
instructions are addic. and andis.. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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andis. 
AND Immediate Shifted 


andis. RA, RS, IM 


(RA) <— (RS) A (IM || 190) 


The IM field is extended to 32 bits by concatenating 16 0-bits on its right. The contents of register RS 
are ANDed with the extended IM field; the result is placed into register RA. 


Registers Altered 

« RA 

* CRICRO]L, at, Ea, so 

Programming Note 

The andis. instruction can test whether any of the 16 most-significant bits in a GPR are 1-bits. 


andis. is one of three instructions that implicitly update CR[CRO] without having an Rc field. The other 
instructions are addic. and andi... 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


9-18 PPC405 Core User’s Manual 


b 


Branch 
b target AA=0, LK=0 
ba target AA=1, LK=0 
bl target AA=0, LK=1 
bla target AA=1, LK=1 

18 Li AA| LK 

0 6 30 31 

If AA = 1 then 


LI <— targetg-og 

NIA < EXTS(LI || 20) 
else 

LI <— (target — CIA)g-o 

NIA <— CIA + EXTS(LI || 20) 
if LK = 1 then 

(LR) <— CIA + 4 
PC < NIA 


The next instruction address (NIA) is the effective address of the branch. The NIA is formed by adding 
a displacement to a base address. The displacement is obtained by concatenating two 0-bits to the 
right of the LI field and sign-extending the result to 32 bits. 


lf the AA field contains 0, the base address is the address of the branch instruction, which is also the 
current instruction address (CIA). If the AA field contains 1, the base address is 0. 


Program flow is transferred to the NIA. 


If the LK field contains 1, then (CIA + 4) is placed into the LR. 


Registers Altered 
¢ LRif LK contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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bc 


Branch Conditional 


bc BO, BI, target AA=0, LK=0 
bca BO, BI, target AA=1, LK=0 
bcl BO, BI, target AA=0, LK=1 
bcla BO, BI, target AA=1, LK=1 
16 BO BI BD AA| LK 
0 6 11 16 30 31 
if BOo = O then 


CTR < CTR —- 1 
if (BOz =1 v ((CTR = 0) = BO3)) A (BOg = 1 Vv (CRp; = BO,)) then 
if AA = 1 then 
BD < targetyg¢-29 
NIA <— EXTS(BD || 20) 
else 
BD < (target — CIA)1g-29 
NIA < CIA + EXTS(BD || 20) 
else 
NIA <— CIA + 4 
if LK = 1 then 
(LR) — CIA + 4 
PC < NIA 


If bit 2 of the BO field contains 0, the CTR decrements. 
The BI field specifies a bit in the CR to be used as the condition of the branch. 


The next instruction address (NIA) is the effective address of the branch. The NIA is formed by adding 
a displacement to a base address. The displacement is obtained by concatenating two 0-bits to the 
right of the BD field and sign-extending the result to 32 bits. 


If the AA field contains 0, the base address is the address of the branch instruction, which is also the 
current instruction address (CIA). If the AA field contains 1, the base address is 0. 


The BO field controls options that determine when program flow is transferred to the NIA. The BO 
field also controls branch prediction, a performance-improvement feature. See “Branch Prediction” on 
page 2-26 for a complete discussion. 


If the LK field contains 1, then (CIA + 4) is placed into the LR. 


Registers Altered 


* CTR if BOs contains 0 
¢ LR if LK contains 1 


9-20 PPC405 Core User’s Manual 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


bc 


Branch Conditional 


Table 9-7. Extended Mnemonics for bc, bea, bcl, bcla 


Mnemonic | Operands 


bdnz target 


bdnza 


bdnzl 


bdnzla 


Function 


Decrement CTR; branch if CTR #0. 


Extended mnemonic for 
be 16,0,target 


Other Registers 
Altered 


Extended mnemonic for 
bea 16,0,target 


Extended mnemonic for 
bel 16,0,target 


(LR) —CIA +4. 


Extended mnemonic for 
bcla 16,0,target 


(LR) —CIA +4. 


bdnzf cr_bit, target 


bdnzfa 


bdnzfl 


bdnzfla 


Decrement CTR. 


Branch if CTR # 0 AND CR, pit = 0. 


Extended mnemonic for 
be 0,cr_bit,target 


Extended mnemonic for 
bea 0,cr_bit,target 


Extended mnemonic for 
bel 0,cr_bit,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 0,cr_bit,target 


(LR) —CIA +4. 


bdnzt cr_bit, target 


bdnzta 


bdnztl 


bdnzila 


Decrement CTR. 


Branch if CTR #0 AND CRe pit = 1- 


Extended mnemonic for 
be 8,cr_bit,target 


Extended mnemonic for 
bea 8,cr_bit,target 


Extended mnemonic for 
bel 8,cr_bit,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 8,cr_bit,target 


(LR) —CIA +4. 


bdz target 


bdza 


bdzl 


bdzla 


Decrement CTR; branch if CTR = 0. 


Extended mnemonic for 
be 18,0,target 


Extended mnemonic for 
bea 18,0,target 


Extended mnemonic for 
bel 18,0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 18,0,target 


(LR) —CIA +4. 
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bc 


Branch Conditional 


Table 9-7. Extended Mnemonics for bc, bca, bcl, bcla (continued) 


Mnem 


bdzf 


onic | Operands 


cr_bit, target 


bdzfa 


bdzfl 


bdzfla 


Function 


Decrement CTR 

Branch if CTR = 0 AND CR pit = 0. 
Extended mnemonic for 
be 2,cr_bit,target 


Other Registers 
Altered 


Extended mnemonic for 
bea 2,cr_bit,target 


Extended mnemonic for 
bel 2,cr_bit,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 2,cr_bit,target 


(LR) — CIA +4. 


bdzt 


cr_bit, target 


bdzta 


bdztl 


bdztla 


Decrement CTR. 

Branch if CTR = 0 AND CR pit = 1. 
Extended mnemonic for 
be 10,cr_bit,target 


Extended mnemonic for 
bea 10,cr_bit,target 


Extended mnemonic for 
bel 10,cr_bit,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 10,cr_bit,target 


(LR) —CIA +4. 


beq 


[cr_field,] 
target 


beqa 


beql 


beqla 


Branch if equal. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+2,target 


Extended mnemonic for 
bea 12,4«cr_field+2,target 


Extended mnemonic for 
bel 12,4«cr_field+2,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+2,target 


(LR) —CIA +4. 


bf 


cr_bit, target 


bfa 


bfl 


bfla 


Branch if CRer pit = 0. 
Extended mnemonic for 
be 4,cr_bit,target 


Extended mnemonic for 
bea 4,cr_bit,target 


Extended mnemonic for 
bel 4,cr_bit,target 


LR 


Extended mnemonic for 
bela 4,cr_bit,target 


LR 
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bc 


Branch Conditional 


Table 9-7. Extended Mnemonics for bc, bca, bcl, bcla (continued) 


Other Registers 


Mnemonic | Operands Function Altered 
bge [cr_field,] Branch if greater than or equal. 
target Use CRO if cr_field is omitted. 


Extended mnemonic for 
be 4,4«cr_field+0,target 


bgea Extended mnemonic for 
bea 4,4«cr_field+0,target 

bgel Extended mnemonic for LR 
bel 4,4«cr_field+0,target 

bgela Extended mnemonic for LR 
bela 4,4«cr_field+0,target 

bgt [cr_field,] Branch if greater than. 

target Use CRO if cr_field is omitted. 


Extended mnemonic for 
be 12,4«cr_field+1,target 


bgta Extended mnemonic for 
bea 12,4«cr_field+1,target 

bgtl Extended mnemonic for LR 
bel 12,4«cr_field+1,target 

bgtla Extended mnemonic for LR 
bela 12,4«cr_field+1,target 

ble [cr_field,] Branch if less than or equal. 

target Use CRO if cr_field is omitted. 


Extended mnemonic for 
be 4,4«cr_field+1,target 


blea Extended mnemonic for 
bea 4,4«cr_field+1,target 

blel Extended mnemonic for LR 
bel 4,4«cr_field+1,target 

blela Extended mnemonic for LR 
bela 4,4«cr_field+1,target 

bit [cr_field,] Branch if less than 

target Use CRO if cr_field is omitted. 


Extended mnemonic for 
be 12,4«cr_field+0,target 


blta Extended mnemonic for 
bea 12,4«cr_field+0,target 
bitl Extended mnemonic for (LR) < CIA + 4. 


bel 12,4«cr_field+0,target 


bitla Extended mnemonic for (LR) < CIA + 4. 
bela 12,4«cr_field+0,target 


Instruction Set 9-23 


bc 


Branch Conditional 


Table 9-7. Extended Mnemonics for bc, bca, bcl, bcla (continued) 


bne 


Mnemonic | Operands 


[cr_field,] 
target 


bnea 


bnel 


bnela 


Function 


Branch if not equal. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+2,target 


Other Registers 
Altered 


Extended mnemonic for 
bea 4,4«cr_field+2,target 


Extended mnemonic for 
bel 4,4*cr_field+2,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+2,target 


(LR) —CIA +4. 


bng 


[cr_field,] 
target 


bnga 


bngl 


bngla 


Branch if not greater than. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+1,target 


Extended mnemonic for 
bea 4,4«cr_field+1,target 


Extended mnemonic for 
bel 4,4«cr_field+1,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+1,target 


(LR) —CIA +4. 


bnl 


[cr_field,] 
target 


bnla 


bnil 


bnila 


Branch if not less than; use CRO if cr_field is omitted. 


Extended mnemonic for 
be 4,4«cr_field+0,target 


Extended mnemonic for 
bea 4,4«cr_field+0,target 


Extended mnemonic for 
bel 4,4«cr_field+0,target 


(LR) —CIA +4. 


Extended mnemonic for 
bcla 4,4«cr_field+0,target 


(LR) —CIA +4. 


bns 


[cr_field,] 
target 


bnsa 


bnsl 


bnsla 


Branch if not summary overflow. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+3,target 


Extended mnemonic for 
bea 4,4«cr_field+3,target 


Extended mnemonic for 
bel 4,4«cr_field+3,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+3,target 


(LR) — CIA +4. 
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bc 


Branch Conditional 


Table 9-7. Extended Mnemonics for bc, bca, bcl, bcla (continued) 


Mnemonic 


bnu 


Operands 


[cr_field,] 
target 


bnua 


bnul 


bnula 


Function 


Branch if not unordered. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+3,target 


Other Registers 


Altered 


Extended mnemonic for 
bea 4,4«cr_field+3,target 


Extended mnemonic for 
bel 4,4«cr_field+3,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+3,target 


(LR) —CIA +4. 


bso 


[cr_field,] 
target 


bsoa 


bsol 


bsola 


Branch if summary overflow. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+3,target 


Extended mnemonic for 
bea 12,4«cr_field+3,target 


Extended mnemonic for 
bel 12,4«cr_field+3,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+3,target 


(LR) —CIA +4. 


bt 


cr_bit, target 


bta 


btl 


btla 


Branch if CRer pit = 1- 
Extended mnemonic for 
be 12,cr_bit,target 


Extended mnemonic for 
bea 12,cr_bit,target 


Extended mnemonic for 
bel 12,cr_bit,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 12,cr_bit,target 


(LR) —CIA +4. 


bun 


[cr_field], 
target 


buna 


bunl 


bunla 


Branch if unordered. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+3,target 


Extended mnemonic for 
bea 12,4«cr_field+3,target 


Extended mnemonic for 
bel 12,4«cr_field+3,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+3,target 


(LR) —CIA +4. 


Instruction Set 


9-25 


bcctr 


Branch Conditional to Count Register 


bectr BO, BI LK=0 
bectrl BO, BI LK=1 
19 BO BI 528 LK 
0 6 11 16 21 31 
if BOo = O then 


CTR < CTR —- 1 
if (BOo =1 v ((CTR = 0) = BOsg)) A (BOp = 1 V (CRp; = BO};)) then 
NIA <— CTRo-29 || 70 
else 
NIA < CIA + 4 
if LK = 1 then 
(LR) < CIA + 4 
PC ¢ NIA 


The BI field specifies a bit in the CR to be used as the condition of the branch. 


The next instruction address (NIA) is the target address of the branch. The NIA is formed by 
concatenating the 30 most significant bits of the CTR with two 0-bits on the right. 


The BO field controls options that determine when program flow is transferred to the NIA. The BO 
field also controls branch prediction, a performance-improvement feature. See “Branch Prediction” on 
page 2-26 for a complete discussion. 


If the LK field contains 1, then (CIA + 4) is placed into the LR. 
Registers Altered 

¢ CTR if BOs contains 0 

¢ LR if LK contains 1 

Invalid Instruction Forms 

¢ Reserved fields 


¢ If bit 2 of the BO field contains 0, the instruction form is invalid, but the pseudocode applies. If the 
branch condition is true, the branch is taken; the NIA is the contents of the CTR after it is 
decremented. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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bcectr 


Branch Conditional to Count Register 


Table 9-8. Extended Mnemonics for bcctr, bcctrl 


Other Registers 


Mnemonic | Operands Function Altered 
betr Branch unconditionally to address in CTR. 
Extended mnemonic for 
bectr 20,0 
betrl Extended mnemonic for (LR) < CIA + 4. 
bcctrl 20,0 
beqctr [cr_field] Branch, if equal, to address in CTR 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+2 


begctrl Extended mnemonic for (LR) < CIA + 4. 
bectrl 12,4«cr_field+2 
bfctr cr_bit Branch, if CRe- pit = 0, to address in CTR. 


Extended mnemonic for 
bectr 4,cr_bit 


bfctrl Extended mnemonic for (LR) < CIA + 4. 
bectrl 4,cr_bit 


bgectr [cr_field] Branch, if greater than or equal, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+0 


bgectrl Extended mnemonic for (LR) < CIA + 4. 
bectrl 4,4*cr_field+0 


bgtctr [cr_field] Branch, if greater than, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 12,4*cr_field+1 


bgtctrl Extended mnemonic for (LR) < CIA + 4. 
bectrl 12,4«cr_field+1 


blectr [cr_field] Branch, if less than or equal, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+1 


blectrl Extended mnemonic for (LR) < CIA + 4. 
bectrl 4,4*cr_field+1 
bltctr [cr_field] Branch, if less than, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+0 


bltctrl Extended mnemonic for (LR) < CIA + 4. 
bectrl 12,4«cr_field+0 


Instruction Set 9-27 


bcctr 


Branch Conditional to Count Register 


Table 9-8. Extended Mnemonics for bcctr, bcctrl (continued) 


Mnemonic 


bnectr 


bnectrl 


Operands 


[cr_field] 


Function 


Branch, if not equal, to address in CTR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4«cr_field+2 


Other Registers 
Altered 


Extended mnemonic for 
bectrl 4,4*cr_field+2 


(LR) —CIA +4. 


bngctr 


bngctrl 


[cr_field] 


Branch, if not greater than, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+1 


Extended mnemonic for 
bectrl 4,4*«cr_field+1 


(LR) —CIA +4. 


bnictr 


bnictrl 


[cr_field] 


Branch, if not less than, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+0 


Extended mnemonic for 
bectrl 4,4*cr_field+0 


(LR) —CIA +4. 


bnsctr 


bnsctrl 


[cr_field] 


Branch, if not summary overflow, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+3 


Extended mnemonic for 
bectrl 4,4*cr_field+3 


(LR) —CIA +4. 


bnuctr 


bnuctrl 


[cr_field] 


Branch, if not unordered, to address in CTR; use CRO 
if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+3 


Extended mnemonic for 
bectrl 4,4*cr_field+3 


(LR) — CIA +4. 


bsoctr 


bsoctrl 


[cr_field] 


Branch, if summary overflow, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 12,4*cr_field+3 


Extended mnemonic for 
bectrl 12,4«cr_field+3 


(LR) —CIA +4. 


btctr 


btctrl 


cr_bit 


Branch if CRer pit = 1 to address in CTR. 
Extended mnemonic for 
bectr 12,cr_bit 


Extended mnemonic for 
bectrl 12,cr_bit 


(LR) —CIA +4. 
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bectr 


Branch Conditional to Count Register 


Table 9-8. Extended Mnemonics for bcctr, bcctrl (continued) 


Mnemonic 


bunctr 


bunctrl 


Operands 


[cr_field] 


Function 


Branch if unordered to address in CTR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4*cr_field+3 


Other Registers 
Altered 


Extended mnemonic for 
bectrl 12,4*cr_field+3 


(LR) —CIA +4. 


Instruction Set 


9-29 


belr 


Branch Conditional to Link Register 


belr BO, BI LK=0 
belrl BO, BI LK =1 
19 BO BI 16 LK 
0 6 ih 16 21 31 
if BOo = 0 then 
CTR < CTR —- 1 
if (BOp =1 v ((CTR = 0) = BO3)) A (BOp = 1 v (CRp; = BO})) then 
NIA <— LRo-29 ll 20 
else 
NIA — CIA + 4 
if LK = 1 then 
(LR) — CIA + 4 
PC < NIA 
If bit 2 of the BO field contains 0, the CTR is decremented. 
The BI field specifies a bit in the CR to be used as the condition of the branch. 
The next instruction address (NIA) is the target address of the branch. The NIA is formed by 
concatenating the 30 most significant bits of the LR with two 0-bits on the right. 
The BO field controls options that determine when program flow is transferred to the NIA. The BO 
field also controls branch prediction, a performance-improvement feature. See “Branch Prediction” on 


page 2-26 for a complete discussion. 


If the LK field contains 1, then (CIA + 4) is placed into the LR. 


Registers Altered 


* CTR if BOs contains 0 
¢ LRif LK contains 1 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-9. Extended Mnemonics for belr, bclrl 


Other Registers 
Mnemonic | Operands Function Altered 
blir Branch unconditionally to address in LR. 
Extended mnemonic for 
belr 20,0 
birl Extended mnemonic for (LR) < CIA + 4. 
belrl 20,0 
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belr 


Branch Conditional to Link Register 


Table 9-9. Extended Mnemonics for bclr, bclrl (continued) 


Mnemonic 


bdnzlr 


bdnzirl 


Operands 


Function 


Decrement CTR. 

Branch if CTR # 0 to address in LR. 
Extended mnemonic for 
belr 16,0 


Other Registers 
Altered 


Extended mnemonic for 
belrl 16,0 


(LR) — CIA +4. 


bdnzfir 


bdnzfirl 


cr_bit 


Decrement CTR. 


Branch if CTR #0 AND CR, pit = 0 to address in LR. 


Extended mnemonic for 
belr 0,cr_bit 


Extended mnemonic for 
belrl 0,cr_bit 


(LR) — CIA +4. 


bdnztlr 


bdnztirl 


cr_bit 


Decrement CTR. 


Branch if CTR #0 AND CR, pit = 1 to address in LR. 


Extended mnemonic for 
belr 8,cr_bit 


Extended mnemonic for 
belrl 8,cr_bit 


(LR) —CIA +4. 


bdzir 


bdzirl 


Decrement CTR. 

Branch if CTR = 0 to address in LR. 
Extended mnemonic for 
belr 18,0 


Extended mnemonic for 
belrl 18,0 


(LR) — CIA +4. 


bdzfir 


bdzfirl 


cr_bit 


Decrement CTR. 


Branch if CTR = 0 AND CRe, pit = 0 to address in LR. 


Extended mnemonic for 
belr 2,cr_bit 


Extended mnemonic for 
belrl 2,cr_bit 


(LR) —CIA +4. 


bdztir 


bdztirl 


cr_bit 


Decrement CTR. 


Branch if CTR = 0 AND CRe, pit = 1 to address in LR. 


Extended mnemonic for 
belr 10,cr_bit 


Extended mnemonic for 
belrl 10,cr_bit 


(LR) —CIA +4. 


beqIr 


beqIrl 


[cr_field] 


Branch if equal to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4«cr_field+2 


Extended mnemonic for 
belrl 12,4«cr_field+2 


(LR) — CIA +4. 


Instruction Set 


9-31 


belr 


Branch Conditional to Link Register 


Table 9-9. Extended Mnemonics for bclr, bclrl (continued) 


Mnemonic | Operands 


bfir cr_bit 


bfirl 


Function 


Branch if CRer pit = 0 to address in LR. 
Extended mnemonic for 
belr 4,cr_bit 


Other Registers 
Altered 


Extended mnemonic for 
belrl 4,cr_bit 


(LR) — CIA +4. 


bgelr [cr_field] 


bgelrl 


Branch, if greater than or equal, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+0 


Extended mnemonic for 
belrl 4,4«cr_field+0 


(LR) — CIA +4. 


bgtir [cr_field] 


bgtirl 


Branch, if greater than, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 12,4«cr_field+1 


Extended mnemonic for 
belrl 12,4*cr_field+1 


(LR) — CIA +4. 


blelr [cr_field] 


blelrl 


Branch, if less than or equal, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+1 


Extended mnemonic for 
belrl 4,4«cr_field+1 


(LR) — CIA +4. 


bitir [cr_field] 


bltirl 


Branch, if less than, to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4«cr_field+0 


Extended mnemonic for 
belrl 12,4*cr_field+0 


(LR) — CIA +4. 


bnelr [cr_field] 


bnelrl 


Branch, if not equal, to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+2 


Extended mnemonic for 
belrl 4,4«cr_field+2 


(LR) — CIA +4. 


bnglr [cr_field] 


bnglrl 


Branch, if not greater than, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+1 


Extended mnemonic for 
belrl 4,4«cr_field+1 


(LR) — CIA +4. 


9-32 PPC405 Core User’s Manual 


belr 


Branch Conditional to Link Register 


Table 9-9. Extended Mnemonics for bclr, bclrl (continued) 


Mnemonic 


bnilr 


bnilrl 


Operands 


[cr_field] 


Function 


Branch, if not less than, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+0 


Other Registers 
Altered 


Extended mnemonic for 
belrl 4,4«cr_field+0 


(LR) — CIA +4. 


bnslir 


bnsirl 


[cr_field] 


Branch if not summary overflow to address in LR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+3 


Extended mnemonic for 
belrl 4,4«cr_field+3 


(LR) — CIA +4. 


bnulr 


bnulrl 


[cr_field] 


Branch if not unordered to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+3 


Extended mnemonic for 
belrl 4,4«cr_field+3 


(LR) —CIA +4. 


bsolr 


bsolrl 


[cr_field] 


Branch if summary overflow to address in LR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4*cr_field+3 


Extended mnemonic for 
belrl 12,4«cr_field+3 


(LR) — CIA +4. 


btir 


btirl 


cr_bit 


Branch if CR pit = 1 to address in LR. 
Extended mnemonic for 
belr 12,cr_bit 


Extended mnemonic for 
belrl 12,cr_bit 


(LR) —CIA +4. 


bunir 


bunirl 


[cr_field] 


Branch if unordered to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4*cr_field+3 


Extended mnemonic for 
belrl 12,4«cr_field+3 


(LR) — CIA +4. 


Instruction Set 9-33 


cmp 


Compare 
cmp BF, 0, RA, RB 
31 BF RA RB 0 
) 6 9 11 16 21 31 
Co:3 <— 40 


if (RA) < (RB) then cg < 1 
i ) > (RB) then cy <1 
if (RA) = (RB) then co < 1 
cz < XER[SO] 

n<¢ BF 

CR[CRn] < Co-3 


The contents of register RA are compared with the contents of register RB using a 32-bit signed 
compare. 


The CR field specified by the BF field is updated to reflect the results of the compare and the value of 
XER[SO] is placed into the same CR field. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ CR[CRn] where nis specified by the BF field 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 


The PowerPC Architecture defines this instruction as cmp BF,L,RA,RB, where L selects operand 
size for 64-bit PowerPC implementations. For all 32-bit PowerPC implementations, L = 0 is required 
(L = 1 is an invalid form); hence for PPC405 core, use of the extended mnemonic cmpw BF,RA,RB 
is recommended. 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-10. Extended Mnemonics for cmp 


Other Registers 
Mnemonic | Operands Function Altered 


cmpw [BF,] RA, RB | Compare Word; use CRO if BF is omitted. 
Extended mnemonic for 
cmp BF,0,RA,RB 
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cmpi 


Compare Immediate 


cmpi BF, 0, RA, IM 


11 BF RA IM 


C9-3 <— 40 

A) < EXTS(IM) then cg < 1 
A) > EXTS(IM) thenc, < 1 
A) = EXTS(IM) then co < 1 
c3; < XER[SO] 

n< BF 

CR[CRn] < ¢o.3 


The IM field is sign-extended to 32 bits. The contents of register RA are compared with the extended 
IM field, using a 32-bit signed compare. 


The GR field specified by the BF field is updated to reflect the results of the compare and the value of 
XER[SO] is placed into the same CR field. 


Registers Altered 

¢ CR[CRn] where nis specified by the BF field 
Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 


The PowerPC Architecture defines this instruction as cmpi BF,L,RA,IM, where L selects operand 
size for 64-bit PowerPC implementations. For all 32-bit PowerPC implementations, L = 0 is required 
(L = 1 is an invalid form); hence for the PPC405 core, use of the extended mnemonic 

cmpwi BF,RA,IM is recommended. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-11. Extended Mnemonics for cmpi 


Other Registers 
Mnemonic Operands Function Altered 


cmpwi [BF] RA, IM Compare Word Immediate. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmpi BF,0,RA,IM 


Instruction Set 9-35 


cmpl 


Compare Logical 


cmpl BF, 0, RA, RB 
31 BF RA RB 32 
0 6 9 11 16 21 31 
Co:3 — 40 
if (RA) < (RB) thencg <1 
if (RA) > (RB) thenc, <1 
if (RA) = (RB) thenco < 1 
cz <— XER[SO] 
n< BF 


GRI[CRn] < co-3 


The contents of register RA are compared with the contents of register RB, using a 32-bit unsigned 
compare. 


The CR field specified by the BF field is updated to reflect the results of the compare and the value of 
XER[SO] is placed into the same CR field. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ CR[CRn] where nis specified by the BF field 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Notes 


The PowerPC Architecture defines this instruction as cmpI BF,L,RA,RB, where L selects operand 
size for 64-bit PowerPC implementations. For all 32-bit PowerPC implementations, L = 0 is required 
(L = 1 is an invalid form); hence for PPC405 core, use of the extended mnemonic cmplw BF,RA,RB 
is recommended. 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-12. Extended Mnemonics for cmpl 


Other Registers 
Mnemonic | Operands Function Altered 


cmplw [BF,] RA, RB | Compare Logical Word. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmpl BF,0,RA,RB 
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cmpli 


Compare Logical Immediate 


cmpli BF, 0, RA, IM 


10 BF RA IM 


% (160 || IM) then co — 1 
$ (60 || IM) then cy < 1 
= ('60 || IM) then co < 1 


CRI[CRn] < co-3 


The IM field is extended to 32 bits by concatenating 16 0-bits to its left. The contents of register RA 
are compared with IM using a 32-bit unsigned compare. 


The CR field specified by the BF field is updated to reflect the results of the compare and the value of 
XER[SO] is placed into the same CR field. 


Registers Altered 

¢ CR[CRn] where nis specified by the BF field 
Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 


The PowerPC Architecture defines this instruction as cmpli BF,L,RA,IM, where L selects operand 
size for 64-bit PowerPC implementations. For all 32-bit PowerPC implementations, L = 0 is required 
(L =1 is an invalid form); hence for the PPC405 core, use of the extended mnemonic 

cmplwi BF,RA,IM is recommended. 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-13. Extended Mnemonics for cmpli 


Other Registers 
Mnemonic | Operands Function Changed 


cmplwi [BF,] RA, IM | Compare Logical Word Immediate. 
Use CRO if BF is omitted. 
Extended mnemonic for 
cmpli BF,0,RA,IM 


Instruction Set 9-37 


cntlzw 
Count Leading Zeros Word 


entizw RA, RS Rc=0 
entizw. RA, RS Rc=1 
31 RS RA 26 Rc 
0 6 11 16 21 31 
ne 0 
do while n < 32 
if (RS), = 1 then leave 
nen+ 1 
(RA) <n 


The consecutive leading 0 bits in register RS are counted; the count is placed into register RA. 


The count ranges from 0 through 32, inclusive. 


Registers Altered 
* RA 
7 CR[CRO]_7, GT, EQ, SO if Rc contains 1 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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crand 
Condition Register AND 


crand BT, BA, BB 


19 BT BA BB 257 


CRet = CRea A CRep 


The CR bit specified by the BA field is ANDed with the CR bit specified by the BB field; the result is 
placed into the CR bit specified by the BT field. 


Registers Altered 
* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-39 


crandc 
Condition Register AND with Complement 


crandc BT, BA, BB 


19 BT BA BB 129 


CRet = CRea A —=CRep 


The CR bit specified by the BA field is ANDed with the ones complement of the CR bit specified by 
the BB field; the result is placed into the CR bit specified by the BT field. 


Registers Altered 
* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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creqv 


Condition Register Equivalent 


creqv BT, BA, BB 


19 BT BA BB 289 


CRet — -=(CRea ® CRepp) 


The CR bit specified by the BA field is XORed with the CR bit specified by the BB field; the ones 
complement of the result is placed into the CR bit specified by the BT field. 


Registers Altered 
* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-14. Extended Mnemonics for creqv 


Other Registers 
Mnemonic | Operands Function Altered 


crset bx CR set. 
Extended mnemonic for 
creqv bx,bx,bx 


Instruction Set 9-41 


crnand 
Condition Register NAND 


crnand BT, BA, BB 


19 BT BA BB 225 


CRet = =(CRea A CRep) 


The CR bit specified by the BA field is ANDed with the CR bit specified by the BB field; the ones 
complement of the result is placed into the CR bit specified by the BT field. 


Registers Altered 
* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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crnor 
Condition Register NOR 


crnor BT, BA, BB 


19 BT BA BB 33 


CRet << -(CRea v CRep) 


The CR bit specified by the BA field is ORed with the CR bit specified by the BB field; the ones 
complement of the result is placed into the CR bit specified by the BT field. 


Registers Altered 
* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-15. Extended Mnemonics for crnor 


Other Registers 
Mnemonic | Operands Function Altered 
crnot bx, by CR not. 
Extended mnemonic for 
crnor bx,by,by 


Instruction Set 9-43 


cror 
Condition Register OR 


cror BT, BA, BB 


19 BT BA BB 449 


CRet a CRea Vv CRep 


The CR bit specified by the BA field is ORed with the CR bit specified by the BB field; the result is 
placed into the CR bit specified by the BT field. 


Registers Altered 
* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-16. Extended Mnemonics for cror 


Other Registers 
Mnemonic | Operands Function Altered 
crmove bx, by CR move. 
Extended mnemonic for 
cror bx,by,by 
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31 


crore 
Condition Register OR with Complement 


crorc BT, BA, BB 


19 BT BA BB 417 


CRet — CRea Vv —=CRep 


The condition register (CR) bit specified by the BA field is ORed with the ones complement of the CR 
bit specified by the BB field; the result is placed into the CR bit specified by the BT field. 


Registers Altered 
* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-45 


crxor 


Condition Register XOR 


crxor 


BT, BA, BB 


19 


BT 


BA 


193 


CRet - CRea ® CRep 
The CR bit specified by the BA field is XORed with the CR bit specified by the BB field; the result is 


placed into the CR bit specified by the BT field. 


Registers Altered 


* CR 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-17. Extended Mnemonics for crxor 


21 


Mnemonic 


erclr 


Operands 


bx 


crxor bx,bx,bx 


Function 


Condition register clear. 
Extended mnemonic for 


Other Registers 
Altered 


9-46 PPC405 Core User’s Manual 


31 


dcba 


Data Cache Block Allocate 


dcba RA, RB 


31 RA RB 758 


EA < (RA\O) + (RB) 
DCBA\(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


lf the data block at the EA is in the data cache and the EA is marked as cachable and non-write- 
through, the data in the cache block is architecturally undefined. For the PPC405 core, the cache data 
block is set to 0. 


If the data block at the EA is not in the data cache and the EA is marked as cachable and not marked 
as write-through, a cache block is established and set to an architecturally-undefined value. Note that 
no data is read from main storage, as described in the programming note. 


If the data block at the EA is marked as non-cachable, a no-op occurs. 


If the data block at the EA is in the data cache and marked as write-through, architecturally the data in 
the cache block can be left unmodified. Alternatively, the data block at the EA can be undefined in the 
data cache and in main storage. For the PPC405 core, a no-op occurs. 


If the data block at the EA is not in the data cache and marked as write-through, architecturally the 
instruction can establish a cache block and set the block to 0, or a no-op can occur. For the PPC405 
core, a no-op occurs. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Notes 


Because dcba can establish an address in the data cache without copying the contents of that 
address from main storage, the address established can be invalid with respect to main storage. A 
subsequent operation may cause the address to be copied back to main storage, for example, to 
make room for a new cache block; a machine check exception could occur under these 
circumstances. 


dcba provides a hint that a block of storage will soon be stored to or no longer needed; there is no 
need to retain the data in the block. Establishing the line in the cache, without reading from main 
storage, improves performance. 


Instruction Set 9-47 


dcba 


Data Cache Block Allocate 
Exceptions 


This instruction is considered a “store” with respect to data storage exceptions. However, this 
instruction does not cause data storage exceptions or data TLB-miss exceptions. If conditions occur 
that would otherwise cause such exceptions, dcba is treated as a no-op. 


This instruction is considered a “store” with respect to data address compare (DAC) debug 
exceptions. See “Data Storage Interrupt” on page 5-16. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 
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dcbf 


Data Cache Block Flush 


dcbf RA, RB 


31 RA RB 86 


EA < (RA\O) + (RB) 
DCBF(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


If the data block corresponding to the EA is in the data cache and marked as modified (stored into), 
the data block is copied back to main storage and then marked invalid in the data cache. If the data 
block is not marked as modified, it is simply marked invalid in the data cache. The operation is 
performed whether or not the EA is marked as cachable. 


If the data block at the EA is not in the data cache, no operation is performed. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Exceptions 


This instruction is considered a “load” with respect to data storage exceptions. See “Data Storage 
Interrupt” on page 5-16. 


This instruction is considered a “store” with respect to data address compare (DAC) debug 
exceptions. See “Debug Interrupt” on page 5-26. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 


Instruction Set 9-49 


dcbi 


Data Cache Block Invalidate 


debi RA, RB 


31 RA RB 470 


EA < (RA\O) + (RB) 
DCBI(EA) 


31 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


If the data block at the EA is in the data cache, the data block is marked invalid, regardless of whether 


or not the EA is marked as cachable. If modified data existed in the data block prior to the operation 
this instruction, that data is lost. 


If the data block at the EA is not in the data cache, no operation is performed. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Notes 

Execution of this instruction is privileged. 

Exceptions 


This instruction is considered a “store” with respect to data storage exceptions. See “Data Storage 
Interrupt” on page 5-16. 


This instruction is considered a “store” with respect to data address compare (DAC) debug 
exceptions. See “Debug Interrupt” on page 5-26. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Operating Environment. 
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of 


dcbst 


Data Cache Block Store 


dcbst RA, RB 


31 RA RB 54 


EA < (RA\O) + (RB) 
DCBST(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0, and is the contents of register RA otherwise. 


If the data block at the EA is in the data cache and marked as modified, the data block is copied back 
to main storage and marked as unmodified in the data cache. 


lf the data block at the EA is in the data cache, and is not marked as modified, or if the data block at 
the EA is not in the data cache, no operation is performed. 


The operation specified by this instruction is performed whether or not the EA is marked as cachable. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 

Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Exceptions 


This instruction is considered a “load” with respect to data storage exceptions. See “Data Storage 
Interrupt” on page 5-16. 


This instruction is considered a “store” with respect to data address compare (DAC) debug 
exceptions. See “Debug Interrupt” on page 5-26. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 


Instruction Set 9-51 


dcbt 


Data Cache Block Touch 


dcbt RA, RB 


31 RA RB 278 


EA < (RA\O) + (RB) 
DCBT(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 when the RA field is 0, and is the contents of register RA 
otherwise. 


lf the data block at the EA is not in the data cache and the EA is marked as cachable, the block is read 
from main storage into the data cache. 


If the data block at the EA is in the data cache, or if the EA is marked as non-cachable, no operation 
is performed. 


This instruction is not allowed to cause data storage exceptions or data TLB miss exceptions. If 
execution of the instruction would cause such an exception, then no operation is performed, and no 
exception occurs. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Notes 


The debt instruction allows a program to begin a cache block fetch from main storage before the 
program needs the data. The program can later load data from the cache into registers without 
incurring the latency of a cache miss. 


Exceptions 


This instruction is considered a “load” with respect to data storage exceptions. See “Data Storage 
Interrupt” on page 5-16. 


This instruction is considered a “load” with respect to data address compare (DAC) debug exceptions. 
See “Debug Interrupt” on page 5-26. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 
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dcbtst 


Data Cache Block Touch for Store 


dcbist RA, RB 


31 RA RB 246 


EA < (RA\O) + (RB) 
DCBTST(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


lf the data block at the EA is not in the data cache and the EA address is marked as cachable, the 
data block is loaded into the data cache. 


If the EA is marked as non-cachable, or if the data block at the EA is in the data cache, no operation 
is performed. 


This instruction is not allowed to cause data storage exceptions or data TLB miss exceptions. If 
execution of the instruction would cause such an exception, then no operation is performed, and no 
exception occurs. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Notes 


The debtst instruction allows a program to begin a cache block fetch from main storage before the 
program needs the data. The program can later store data from GPRs into the cache block, without 
incurring the latency of a cache miss. 


Architecturally, dcbtst brings data into the cache in “Exclusive” mode, which allows the program to 
alter the cached data. “Exclusive” mode is part of the MESI protocol for multi-processor systems, and 
is not implemented. The implementation of the dcbtst instruction is identical to the implementation of 
the debt instruction. 


Exceptions 


This instruction is considered a “load” with respect to data storage exceptions. See “Data Storage 
Interrupt” on page 5-16. 


This instruction is considered a “load” with respect to data address compare (DAC) debug exceptions. 
See “Debug Interrupt” on page 5-26. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 


Instruction Set 9-53 


dcbz 


Data Cache Block Set to Zero 


dcbz RA, RB 


31 RA RB 1014 


EA < (RA\O) + (RB) 
DCBZ(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


If the data block at the EA is in the data cache and the EA is marked as cachable and non-write- 
through, the data in the cache block is set to 0. 


If the data block at the EA is not in the data cache and the EA is marked as cachable and non-write- 
through, a cache block is established and set to 0. Note that nothing is read from main storage, as 
described in the programming note. 


If the data block at the EA is marked as either write-through or as non-cachable, an alignment 
exception occurs. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


« None 


Invalid Instruction Forms 


¢ Reserved fields 
Programming Notes 


Because dcbz can establish an address in the data cache without copying the contents of that 
address from main storage, the address established may be invalid with respect to the storage 
subsystem. A subsequent operation may cause the address to be copied back to main storage, for 
example, to make room for a new cache block; a machine check exception could occur under these 
circumstances. 


If dcbz is attempted to an EA which is marked as non-cachable, the software alignment exception 
handler should emulate the instruction by storing zeros to the block in main storage. If a data block 
corresponding to the EA exists in the cache, but the EA is non-cachable, stores (including dcbz) to 
that address are considered programming errors (the cache block should previously have been 
flushed). 


If the EA is marked as write-through, the software alignment exception handler should emulate the 
instruction by storing zeros to the block in main storage. An EA that is marked as write-through 
required should also be marked as cachable; when dcbz is attempted to such an address, the 
alignment exception handler should maintain coherency of cache and memory. 
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dcbz 


Data Cache Block Set to Zero 
Exceptions 
An alignment exception occurs if the EA is marked as non-cachable or as write-through. 


This instruction is considered a “store” with respect to data storage exceptions. See “Data Storage 
Interrupt” on page 5-16. 


This instruction is considered a “store” with respect to data address compare (DAC) debug 
exceptions. See “Debug Interrupt” on page 5-26. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 


Instruction Set 9-55 


dccci 


Data Cache Congruence Class Invalidate 


dccci RA, RB 


31 RA RB 454 


EA < (RA\O0) + (RB) 
DCCCI(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


Both cache lines in the congruence class specified by EAjg.9, are invalidated, whether or not they 
match the EA. If modified data existed in the cache congruence class before the operation of this 
instruction, that data is lost. 


The operation specified by this instruction is performed whether or not the EA is marked as cachable. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 

Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 

Execution of this instruction is privileged. 


This instruction is intended for use in the power-on reset routine to invalidate the entire data cache tag 
array before enabling the data cache. A series of dccci instruction should be executed, one for each 
congruence class. Cachability can then be enabled. 


Exceptions 
See “Access Protection for Cache Control Instructions” on page 7-16. 


The execution of an decci instruction can cause a data TLB miss exception, at the specified EA, 
regardless of the non-specific intent of that EA. 


This instruction does not cause data address compare (DAC) debug exceptions. See “Debug 
Interrupt” on page 5-26. 


Architecture Note 


This instruction is implementation-specific and may not be portable to other implementations. 
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dcread 


RT, RA, RB 


dcread 
Data Cache Read 


31 


EA < (RAIO) + (RB) 


if ((CCRO[CIS] = 0) 
if (CCRO[CIS] = 0) 
if (CCRO[CIS] = 1) 
if (CCRO[CIS] = 1) 


CCRO[CWS] = 0)) ( 
CCRO[CWS] = 1)) then ( 
CCRO[CWS] = 0)) ( 
(CCRO[CWS] = 1)) ( 


>>>> 


then < (d-cache data, way A) 
< (d-cache data, way B) 
< (d-cache tag, way A) 


< (d-cache tag, way B) 


RT 
RT 
then (RT 


then (RT 


YS HY WH 


31 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


This instruction is a debugging tool for reading the data cache entries for the congruence class 
specified by EA;g-0g, unless no cache array is present. The cache information is read into register RT. 


If CCRO[CIS] = 0, the information is a word of data cache array data from the addressed congruence 
class. The word is specified by EAo7.99. If EAgq-31 are not 00, an alignment exception occurs. If 
CCRO[CWS] = 0, the data is from the A-way; otherwise; the data is from the B-way. 


If CCRO[CIS] = 1, the information is a cache tag from the addressed congruence class. If 
CCRO[CWS] = 0, the tag is from the A-way; otherwise the tag is from the B-way. 


Data cache tag information is placed into register RT as shown: 


0:19 TAG | Cache Tag 

20:25 Reserved 

26 D Cache Line Dirty 
0 Not dirty 
1 Dirty 

27 V Cache Line Valid 
0 Not valid 
1 Valid 

28:30 Reserved 

31 LRU | Least Recently Used (LRU) 
0 A-way LRU 
1 B-way LRU 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


¢ RT 


Invalid Instruction Forms 


« Reserved fields 


Instruction Set 


9-57 


dcread 
Data Cache Read 


Programming Note 

Execution of this instruction is privileged. 

Exceptions 

If EA is not word-aligned, an alignment exception occurs. 


This instruction is considered a “load” with respect to data storage exceptions, but cannot cause a 
data storage exception. See “Access Protection for Cache Control Instructions” on page 7-16. 


The execution of an dcread instruction can cause a data TLB miss exception, at the specified EA, 
regardless of the non-specific intent of that effective address. 


This instruction is considered a “load” with respect to data address compare (DAC) debug exceptions. 
See “Debug Interrupt” on page 5-26. 


Architecture Note 


This instruction is implementation-specific and may not be portable to other implementations. 
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divw 


Divide Word 
divw RT, RA, RB OE=0, Rc=0 
divw. RT, RA, RB OE=0, Rc=1 
divwo RT, RA, RB OE=1, Rc=0 
divwo. RT, RA, RB OE=1, Rc=1 

31 RT RA RB OE 491 Re 

0 6 11 16 21 22 31 


(RT) < (RA) ~ (RB) 


The contents of register RA are divided by the contents of register RB. The quotient is placed into 
register RT. 


Both the dividend and the divisor are interpreted as signed integers. The quotient is the unique signed 
integer that satisfies: 


dividend = (quotient x divisor) + remainder 


where the remainder has the same sign as the dividend and its magnitude is less than that of the 
divisor. 


If an attempt is made to perform (0x8000 0000 + —1) or (n+ 0), the contents of register RT are 
undefined; if the Re field also contains 1, the contents of CR[CRO]Lt. qt, Eq are undefined. Either 
invalid division operation sets XER[OV, SO] to 1 if the OE field contains 1. 

Registers Altered 

*« RT 

: CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[OV, SO] if OE contains 1 


Programming Note 


The 32-bit remainder can be calculated using the following sequence of instructions: 


divw RT,RA,RB # RT = quotient 
mullw RT,RT,RB # RT = quotient x divisor 
subf RT,RT,RA # RT = remainder 


The sequence does not calculate correct results for the invalid divide operations. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-59 


divwu 
Divide Word Unsigned 


divwu RT, RA, RB OE=0, Rc=0 
divwu. RT, RA, RB OE=0, Rc=1 
divwuo RT, RA, RB OE=1, Rc=0 
divwuo. RT, RA, RB OE=1, Rc=1 
31 RT RA RB OE 459 Re 
0 6 11 16 21 22 31 


(RT) <— (RA) = (RB) 


The contents of register RA are divided by the contents of register RB. The quotient is placed into 
register RT. 


The dividend and the divisor are interpreted as unsigned integers. The quotient is the unique 
unsigned integer that satisfies: 


dividend = (quotient x divisor) + remainder 
If an attempt is made to perform (n+ 0), the contents of register RT are undefined; if the Rc also 
contains 1, the contents of CR[CRO]i+ qt, Eq are also undefined. The invalid division operation also 
sets XER[OV, SO] to 1 if the OE field contains 1. 
Registers Altered 
« RT 
: CR[CRO]_7, GT, EQ, SO if Re contains 1 
¢ XER[OV, SO] if OE contains 1 
Programming Note 


The 32-bit remainder can be calculated using the following sequence of instructions 


divwu RT,RA,RB # RT = quotient 
mullw RT,RT,RB # RT = quotient x divisor 
subf RT,RT,RA # RT = remainder 


This sequence does not calculate the correct result if the divisor is zero. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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eieio 


Enforce In Order Execution of I/O 


eieio 


31 854 


The eieio instruction ensures that all loads and stores preceding eieio complete with respect to main 
storage before any loads and stores following eieio access main storage. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 


Architecturally, eieio orders storage access, not instruction completion. Therefore, non-storage 
operations after eieio could complete before storage operations that were before eieio. The sync 
instruction guarantees ordering of both instruction completion and storage access. For the PPC405 
core, the eieio instruction is implemented to behave as a sync instruction. 


To write code that is portable between various PowerPC implementations, programmers should use 
the mnemonic that corresponds to the desired behavior. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 


Instruction Set 9-61 


eqv 


Equivalent 
eqv RA, RS, RB Rc=0 
eqv. RA, RS, RB Rc=1 
31 RS RB Re 
0 6 11 16 21 31 


(RA) <— -=((RS) © (RB)) 


The contents of register RS are XORed with the contents of register RB; the ones complement of the 


result is placed into register RA. 


Registers Altered 
* RA 
bd CR[CRO]_7, GT, EQ, SO if Rc contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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extsb 
Extend Sign Byte 


extsb RA, RS Rc=0 
extsb. RA, RS Rc=1 
31 RS RA 954 Re 
0 6 1 16 21 31 


(RA) < EXTS(RS)o4:31 


The least significant byte of register RS is sign-extended to 32 bits by replicating bit 24 of the register 
into bits 0 through 23 of the result. The result is placed into register RA. 


Registers Altered 
* RA 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-63 


extsh 
Extend Sign Halfword 


extsh RA, RS Rc=0 
extsh. RA, RS Rc=1 

31 RS RA 922 Re 
0 6 oh 16 21 31 


(RA) <— EXTS(RS)16:31 


The least significant halfword of register RS is sign-extended to 32 bits by replicating bit 16 of the 
register into bits 0 through 15 of the result. The result is placed into register RA. 


Registers Altered 
* RA 
© CR[CRO]_7, GT, EQ, SO if Rc contains 1 


Invalid Instruction Forms 


¢« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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icbi 


Instruction Cache Block Invalidate 


icbi RA, RB 


31 RA RB 982 


EA < (RA\0) + (RB) 
ICBI(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


If the instruction block at the EA is in the instruction cache, the cache block is marked invalid. 
If the instruction block at the EA is not in the instruction cache, no additional operation is performed. 


The operation specified by this instruction is performed whether or not the EA is marked as cachable 
in the ICCR. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 

Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 

Instruction cache operations use MSR[DR], not MSR[IR], to determine translation of their operands. 


When data translation is disabled, cachability for the EA of the operand of instruction cache 
operations is determined by the ICCR, not the DCCR. 


Exceptions 


Instruction storage exceptions and instruction-side TLB miss exceptions are associated with 
instruction fetching, not with instruction execution. Exceptions that occur during the execution of 
instruction cache operations cause data-side exceptions (data storage exceptions and data TLB miss 
exceptions). 


This instruction is considered a “load” with respect to data storage exceptions. See “Data Storage 
Interrupt” on page 5-16. 


This instruction is considered a “load” with respect to data address compare (DAC) debug exceptions. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 


Instruction Set 9-65 


icbt 


Instruction Cache Block Touch 


icbt RA, RB 


31 RA RB 262 


EA< (RA|0) + (RB) 
ICBT(EA) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


If the instruction block at the EA is not in the instruction cache, and is marked as cachable, the 
instruction block is loaded into the instruction cache. 


If the instruction block at the EA is in the instruction cache, or if the EA is marked as non-cachable, no 
operation is performed. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


¢ None 

Invalid Instruction Forms 
¢ Reserved fields 
Programming Notes 


This instruction allows a program to begin a cache block fetch from main storage before the program 
needs the instruction. The program can later branch to the instruction address and fetch the 
instruction from the cache without incurring the latency of a cache miss. 


Instruction cache operations use MSR[DR], not MSR[IR], to determine translation of their operands. 
When data translation is disabled, cachability for the effective address of the operand of instruction 
cache operations is determined by the ICCR, not the DCCR. 


Exceptions 


Instruction storage exceptions and instruction-side TLB miss exceptions are associated with 
instruction fetching, not with instruction execution. Exceptions occurring during execution of 
instruction cache operations cause data storage and data TLB miss exceptions. 


If the execution of an icbt instruction would cause a data TLB miss exception, no operation is 
performed and no exception occurs. 


This instruction is considered a “load” with respect to protection exceptions, but cannot cause data 
storage exceptions. This instruction is also considered a “load” with respect to data address compare 
(DAC) debug exceptions. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Operating Environment. 
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iccci 


Instruction Cache Congruence Class Invalidate 


iccci RA, RB 


31 RA RB 966 


EA < (RA|O0) + (RB) 
ICCCI(ICU cache array) 


This instruction invalidates the entire ICU cache array. The EA is not used; previous implementations 
have used the EA for protection checks. The instruction form is maintained for software and tool 
compatibility. 


Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Notes 

Execution of this instruction is privileged. 


This instruction is intended for use in the power-on reset routine to invalidate the entire cache tag 
array before enabling the cache. Cachability can then be enabled. 


Architecture Note 


This instruction is implementation-specific and may not be portable to other implementations. 


Instruction Set 9-67 


icread 


Instruction Cache Read 


icread RA, RB 


31 RA RB 998 


EA < (RA\O0) + (RB) 


if ((CCRO[CIS] = 0) A (CCRO[CWS] = 0)) then (ICDBDR) < (i-cache data, way A) 
if ((CCRO[CIS] = 0) A (CCRO[CWS] = 1)) then (ICDBDR) < (i-cache data, way B) 
if ((CCRO[CIS] = 1) A (CCRO[CWS] = 0)) then (ICDBDR) < (i-cache tag, way A) 
if ((CCRO[CIS] = 1) A (CCRO[CWS] = 1)) then (ICDBDR) < (i-cache tag, way B) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


This instruction is a debugging tool for reading the instruction cache entries for the congruence class 
specified by EA;g-9g, unless no cache array is present. The cache information is read into the 
Instruction Cache Debug Data Register (ICDBDR), from where it can be read into a GPR using the 
extended mnemonic mficdbdr. 


If CCRO[CIS] = 0, the information is a word of instruction cache data from the addressed line. The 
word is specified by EAp97.99. If CCRO[CWS] = 0, the data is from the A-way, otherwise from the B-way. 


If (CCRO[CIS] = 1), the information is a cache tag from the addressed congruence class. If 
(CCRO[CWS] = 0), the tag is from the A-way, otherwise from the B-way. 


Instruction cache tag information is placed in the ICDBDR as shown: 


0:21 TAG Cache Tag 
22:26 Reserved 
27 V Cache Line Valid 
0 Not valid 
1 Valid 
28:30 Reserved 
31 LRU Least Recently Used (LRU) 
0 A-way LRU 
1 B-way LRU 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
* ICDBDR 


Invalid Instruction Forms 


¢ Reserved fields 
Programming Note 


Execution of this instruction is privileged. 
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icread 


Instruction Cache Read 


The instruction pipeline does not automatically wait for data from icread to arrive at the ICDBDR 
before attempting to use the contents of the ICDBDR. Therefore, insert an isync instruction between 
icread and mficdbdr. 


icread r5,r6 # read cache information 
isync # ensure completion of icread 
mficdbdr r7_ # move information to GPR 


Instruction cache operations use MSR[DR], not MSR[IR], to determine translation of their operands. 
When data translation is disabled, cachability for the EA of the operand of instruction cache 
operations is determined by the ICCR, not the DCCR. 


Exceptions 


Instruction storage exceptions and instruction-side TLB miss exceptions are associated with 
instruction fetching, not with instruction execution. Exceptions that occur during the execution of 
instruction cache operations cause data-side exceptions (data storage exceptions and data TLB miss 
exceptions). 


The execution of icread can cause a data TLB miss exception, at the specified EA, regardless of the 
non-specific intent of that EA. 


This instruction is considered a “load” and cannot cause a data storage exception. 


This instruction is considered a “load” with respect to data address compare (DAC) debug exceptions, 
but will not cause DAC debug events. 


Architecture Note 


This instruction is implementation-specific and may not be portable to other implementations. 


Instruction Set 9-69 


isync 


Instruction Synchronize 


isync 


19 150 


The isync instruction is a context synchronizing instruction. 


isync provides an ordering function for the effects of all instructions executed by the processor. 
Executing isync insures that all instructions preceding the isync instruction execute before isync 
completes, except that storage accesses caused by those instructions need not have completed. 


No subsequent instructions are initiated by the processor until isync completes. Finally, execution of 
isync causes the processor to discard any prefetched instructions, with the effect that subsequent 
instructions are fetched and executed in the context established by the instructions preceding isync. 


isync has no effect on caches. 

If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 

Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 

See the discussion of context synchronizing instructions in “Synchronization” on page 2-33. 


The following code example illustrates the necessary steps for self-modifying code. This example 
assumes that addr1 is both data and instruction cachable. 


stw regN, addr1 # data in regN is to become an instruction at addr1 
dcbst addr1 # forces data from the data cache to memory 
sync # wait until the data actually reaches the memory 
icbi adar1 # the previous value at addr1 might already be in 
the instruction cache; invalidate in the cache 
isync # the previous value at addr1 might already have been 


pre-fetched into the queue; invalidate the queue 
so that the instruction must be re-fetched 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 
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Ibz 


Load Byte and Zero 


Ibz RT, D(RA) 


EA < (RA\0) + EXTS(D) 
(RT) <— 240 || MS(EA,1) 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 if the RA field is 0 and 
is the contents of register RA otherwise. 


The byte at the EA is extended to 32 bits by concatenating 24 0-bits to its left. The result is placed into 
register RT. 


Registers Altered 
¢ RT 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-71 


Ibzu 
Load Byte and Zero with Update 


Ibzu RT, D(RA) 


EA <— (RAO) + EXTS(D) 
(RA) — EA 
(RT) <— 240 || MS(EA,1) 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 if the RA field is 0 and 
is the contents of register RA otherwise. The EA is placed into register RA. 


The byte at the EA is extended to 32 bits by concatenating 24 0-bits to its left. The result is placed into 
register RT. 


Registers Altered 
* RA 


Invalid Instruction Forms 
« RA=RT 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Ibzux 


Load Byte and Zero with Update Indexed 


Ibzux RT, RA, RB 


31 RT RA RB 


119 


EA < (RA\O) + (RB) 
(RA) — EA 
(RT) <— 240 || MS(EA,1) 


31 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The EA is placed into register RA. 


The byte at the EA is extended to 32 bits by concatenating 24 0-bits to its left. The result is placed into 


register RT. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
* RA 


Invalid Instruction Forms 


« Reserved fields 
* RA=RT 
« RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 


9-73 


Ibzx 
Load Byte and Zero Indexed 


Ibzx RT,RA, RB 


31 RT RA RB 87 


EA < (RA\O0) + (RB) 
(RT) <— 240 || MS(EA,1) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The byte at the EA is extended to 32 bits by concatenating 24 0-bits to its left. The result is placed into 
register RT. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
¢ RT 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Ilha 


Load Halfword Algebraic 


Iha RT, D(RA) 


42 RT RA D 


EA < (RA\0) + EXTS(D) 
(RT) <— EXTS(MS(EA,2)) 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 if the RA field is 0 and 
is the contents of register RA otherwise. 


The halfword at the EA is sign-extended to 32 bits and placed into register RT. 


Registers Altered 
« RT 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-75 


Ihau 
Load Halfword Algebraic with Update 


Ihau RT, D(RA) 


EA < (RA) + EXTS(D) 
(RA) — EA 
(RT) <— EXTS(MS(EA,2)) 


An effective address (EA) is formed by adding a displacement to the base address in register RA. The 
displacement is obtained by sign-extending the 16-bit D field to 32 bits. The EA is placed into register 
RA. 


The halfword at the EA is sign-extended to 32 bits and placed into register RT. 


Registers Altered 
* RA 


Invalid Instruction Forms 
« RA=RT 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Ihaux 
Load Halfword Algebraic with Update Indexed 


Ihaux RT, RA, RB 


31 RT RA RB 375 


EA < (RA) + (RB) 
(RA) — EA 
(RT) <— EXTS(MS(EA,2)) 


An effective address (EA) is formed by adding an index to the base address in register RA. The index 
is the contents of register RB. The EA is placed into register RA. 


The halfword at the EA is sign-extended to 32 bits and placed into register RT. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
*« RA 


Invalid Instruction Forms 


¢ Reserved fields 
* RA=RT 
- RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-77 


Ihax 
Load Halfword Algebraic Indexed 


lhax RT, RA, RB 


31 RT RA RB 343 


EA < (RA\O) + (RB) 
(RT) <— EXTS(MS(EA,2)) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The halfword at the EA is sign-extended to 32 bits and placed into register RT. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ RT 

Invalid Instruction Forms 

¢ Reserved fields 

Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Ihbrx 


Load Halfword Byte-Reverse Indexed 


Ihbrx RT, RA, RB 


31 RT RA RB 790 


EA <— (RA\0) + (RB) 
(RT) <— 160 || MS(EA +1,1) || MS(EA,1) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The halfword at the EA is byte-reversed. The resulting halfword is extended to 32 bits by 
concatenating 16 0-bits to its left. The result is placed into register RT. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
¢ RT 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-79 


Ihz 


Load Halfword and Zero 


Ihz RT, D(RA) 


EA <— (RAO) + EXTS(D) 
(RT) — 160 || MS(EA,2) 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 if the RA field is 0 and 
is the contents of register RA otherwise. 


The halfword at the EA is extended to 32 bits by concatenating 16 O-bits to its left. The result is placed 
into register RT. 


Registers Altered 
¢ RT 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Ihzu 
Load Halfword and Zero with Update 


Ihzu RT, D(RA) 


41 RT RA D 


EA < (RA) + EXTS(D) 
(RA) — EA 
(RT) <— 180 || MS(EA,2) 


An effective address (EA) is formed by adding a displacement to the base address in register RA. The 
displacement is obtained by sign-extending the 16-bit D field to 32 bits. The EA is placed into register 
RA. 


The halfword at the EA is extended to 32 bits by concatenating 16 0-bits to its left. The result is placed 
into register RT. 


Registers Altered 
* RA 


Invalid Instruction Forms 
« RA=RT 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-81 


Ihzux 
Load Halfword and Zero with Update Indexed 


Ihzux RT, RA, RB 


31 RT RA RB 311 


EA < (RA) + (RB) 
(RA) — EA 
(RT) <— 180 || MS(EA,2) 


An effective address (EA) is formed by adding an index to the base address in register RA. The index 
is the contents of register RB. The EA is placed into register RA. 


The halfword at the EA is extended to 32 bits by concatenating 16 0-bits to its left. The result is placed 
into register RT. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
* RA 


Invalid Instruction Forms 


« Reserved fields 
* RA=RT 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Ihzx 


RT, RA, RB 


Ihzx 


Load Halfword and Zero Indexed 


31 


RB 


279 


EA < (RA\O) + (RB) 
(RT) <— 180 || MS(EA,2) 


21 


31 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The halfword at the EA is extended to 32 bits by concatenating 16 O-bits to its left. The result is placed 


into register RT. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


¢ RT 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 


9-83 


Iimw 
Load Multiple Word 


Imw RT, D(RA) 


EA < (RA\0) + EXTS(D) 


r <— RT 
do while r < 31 
if ((r # RA) v (r = 31)) then 
(GPR(r)) <— MS(EA,4) 
rere 
EA < EA + 4 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field in the instruction to 32 bits. The base address is 0 if the 
RA field is 0 and is the contents of register RA otherwise. 


A series of consecutive words starting at the EA are loaded into a set of consecutive GPRs, starting 
with register RT and continuing to and including GPR(31). Register RA is not altered by this 
instruction (unless RA is GPR(81), which is an invalid form of this instruction). The word which would 
have been placed into register RA is discarded. 


Registers Altered 
¢ RT through GPR(31). 


Invalid Instruction Forms 


« RA is in the range of registers to be loaded, including the case RA = RT = 0. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Iswi 
Load String Word Immediate 


Iswi RT, RA, NB 


31 RT RA NB 597 


EA < (RA|0) 
if NB = O then 
CNT < 32 
else 
CNT < NB 
n< CNT 
Reina < ((RT + CEIL(CNT/4) — 1) % 32) 
r<¢ RT -1 
ic¢ 0 
do while n > 0 
if i = O then 
rere 
if r = 32 then 
r<O0 
if ((r - RA) V (r = Reina)) then 
(GPR(r)) <— 0 
if ((r a RA) V (r = Reina)) then 
(GPR(t)i:i47) <— MS(EA,1) 
ic i+8 
if i = 32 then 
ic 0 
EA < EA +1 
nen- 


An effective address (EA) is determined by the RA field. If the RA field contains 0, the EA is 0. 
Otherwise, the EA is the contents of register RA. 


The NB field specifies the byte count CNT. If the NB field contains 0, the byte count is CNT = 32. 
Otherwise, the byte count is CNT = NB. 


A series of CNT consecutive bytes in main storage, starting at the EA, are loaded into CEIL(CNT/4) 
consecutive GPRs, four bytes per GPR, until the byte count is exhausted. Bytes are loaded into 
GPRes; the byte at the lowest address is loaded into the most significant byte. Bits to the right of the 
last byte loaded into the last GPR are set to 0. 


The set of loaded GPRs starts at register RT, continues consecutively through GPR(31), and wraps to 
register 0, loading until the byte count is exhausted, which occurs in register Reina. Register RA is 
not altered (unless RA = Reyna_, an invalid form of this instruction). Bytes which would have been 
loaded into register RA are discarded. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
« RT and subsequent GPRs as described above. 


Instruction Set 9-85 


Iswi 
Load String Word Immediate 


Invalid Instruction Forms 


¢ Reserved fields 
¢ RA is in the range of registers to be loaded 
* RA=RT=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Iswx 
Load String Word Indexed 


Iswx RT, RA, RB 


31 RT RA RB 533 


EA < (RA|O0) + (RB) 
CNT < XER[TBC] 
n<& CNT 
Reina < ((RT + CEIL(CNT/4) — 1) % 32) 
r<¢ RT-1 
ic 0 
do while n > 0 
if i = O then 
rer+ 
if r = 32 then 
r<O0 
if (((r # RA) A (r 4 RB)) v (r = Rejnat)) then 
(GPR(r)) <— 0 
if (((r # RA) A (r 4 RB)) v (r = Rejnat)) then 
(GPR(t)i:i47) <— MS(EA,1) 
ic i+8 
if i = 32 then 
ic 0 
EA < EA +1 
nen- 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


A byte count CNT is obtained from XER[TBC]. 


A series of CNT consecutive bytes in main storage, starting at the EA, are loaded into CEIL(CNT/4) 
consecutive GPRs, four bytes per GPR, until the byte count is exhausted. Bytes are loaded into 
GPRes; the byte having the lowest address is loaded into the most significant byte. Bits to the right of 
the last byte loaded in the last GPR used are set to 0. 


The set of consecutive GPRs loaded starts at register RT, continues through GPR(81), and wraps to 
register 0, loading until the byte count is exhausted, which occurs in register Reina. Register RA is 
not altered (unless RA = Rei at, which is an invalid form of this instruction). Register RB is not altered 
(unless RB = Rejnat; Which is an invalid form of this instruction). Bytes which would have been loaded 
into registers RA or RB are discarded. 


If XER[TBC] is 0, the byte count is 0 and the contents of register RT are undefined. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


« RT and subsequent GPRs as described above. 


Instruction Set 9-87 


Iswx 
Load String Word Indexed 


Invalid Instruction Forms 
« Reserved fields 


¢« RA or RBis in the range of registers to be loaded. 
* RA=RT=0 


Programming Note 
If XER[TBC] = 0, the contents of register RT are unchanged and Iswx is treated as a no-op. 


The PowerPC Architecture states that, if XER[TBC] = 0 and if the EA is such that a precise data 
exception would normally occur (if not for the zero length), Iswx is treated as a no-op and the precise 
exception will not occur. Data storage exceptions and alignment exceptions are examples of precise 
data exceptions. 


However, the PowerPC Architecture makes no statement regarding imprecise exceptions related to 
Iswx with XER[TBC] = 0. The PPC405 core generates an imprecise exception (machine check) on 
this instruction when all of the following conditions are true: 

¢ The instruction passes all protection bounds checking 

¢ The address is cachable 

* The address is passed to the data cache 

¢ The address misses in the data cache (resulting in a line fill request) 

¢ The address encounters some form of bus error 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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lwarx 


Load Word and Reserve Indexed 


lwarx RT, RA, RB 


31 RT RA RB 20 


EA < (RA\O) + (RB) 
RESERVE < 1 
(RT) <— MS(EA,4) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The word at the EA is placed into register RT. 

If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Execution of the Iwarx instruction sets the reservation bit. 

Registers Altered 

« RT 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 


Iwarx and the stwex. instruction should paired in a loop, as shown in the following example, to create 
the effect of an atomic operation to a memory area used as a semaphore between asynchronous 
processes. Only lwarx can set the reservation bit to 1. stwex. sets the reservation bit to 0 upon its 
completion, whether or not stwex. sent (RS) to memory. CR[CRO]eg must be examined to determine 
whether (RS) was sent to memory. 


loop: lwarx # read the semaphore from memory; set reservation 
“alter” # change the semaphore bits in register as required 
stWCx. # attempt to store semaphore; reset reservation 

bne loop # an asynchronous process has intervened; try again 


If the asynchronous process in the code example had paired Iwarx with a store other than stwex., the 
reservation bit would not have been cleared in the asynchronous process, and the code example 
would have overwritten the semaphore. 


Exceptions 


An alignment exception occurs if the EA is not word-aligned. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-89 


lwbrx 
Load Word Byte-Reverse Indexed 


Iwbrx RT, RA, RB 


31 RT RA RB 534 


EA < (RAI0) + (RB) 
(RT) — MS(EA+3,1) || MS(EA+2,1) || MS(EA+1,1) || MS(EA,1) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The word at the EA is byte-reversed: the least significant byte becomes the most significant byte, the 
next least significant byte becomes the next most significant byte, and so on. The resulting word is 
placed into register RT. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
« RT 


Invalid Instruction Forms 


¢« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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lwz 
Load Word and Zero 


lwz RT, D(RA) 


32 RT RA D 


EA < (RA\0) + EXTS(D) 
(RT) — MS(EA,4) 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 if the RA field is 0 and 
is the contents of register RA otherwise. 


The word at the EA is placed into register RT. 


Registers Altered 
« RT 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-91 


lwzu 
Load Word and Zero with Update 


lwzu RT, D(RA) 


EA < (RA) + EXTS(D) 
(RA) — EA 
(RT) — MS(EA,4) 


An effective address (EA) is formed by adding a displacement to the base address in register RA. The 
displacement is obtained by sign-extending the 16-bit D field to 32 bits. The EA is placed into register 
RA. 


The word at the EA is placed into register RT. 


Registers Altered 
* RA 


Invalid Instruction Forms 
« RA=RT 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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lwzux 
Load Word and Zero with Update Indexed 


lwzux RT, RA, RB 


31 RT RA RB 55 


EA < (RA) + (RB) 
(RA) — EA 
(RT) — MS(EA,4) 


An effective address (EA) is formed by adding an index to the base address in register RA. The index 
is the contents of register RB. The EA is placed into register RA. 


The word at the EA is placed into register RT. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
*« RA 


Invalid Instruction Forms 


¢ Reserved fields 
* RA=RT 
- RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-93 


lwzx 
Load Word and Zero Indexed 


lwzx RT, RA, RB 


31 RT RA RB 23 


EA < (RAIO) + (RB) 
(RT) — MS(EA,4) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The word at the EA is placed into register RT. 

If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ RT 

Invalid Instruction Forms 

¢ Reserved fields 

Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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macchw 
Multiply Accumulate Cross Halfword to Word Modulo Signed 


macchw RT, RA, RB OE=0, Rc=0 
macchw. RT, RA, RB OE=0, Rc=1 
macchwo RT, RA, RB OE=1, Rc=0 
macchwo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 172 Re 
0 6 1 16 21 22 31 


prodg:31 < (RA)16:31 X (RB)o-15 signed 
tempo;:32 <— prodg.31 + (RT) 
(RT) <— tempy.32 
The low-order halfword of RA is multiplied by the high-order halfword of RB. The signed product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. The contents of 
RT are replaced by the low-order 32 bits of the temporary register. 
Registers Altered 
« RT 
: CR[CRO]_7, GT, EQ, SO if Rc contains 1 
¢ XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-95 


macchws 
Multiply Accumulate Cross Halfword to Word Saturate Signed 


macchws RT, RA, RB OE=0, Rc=0 
macchws. RT, RA, RB OE=0, Rc=1 
macchwso RT, RA, RB OE=1, Rc=0 
macchwso.__‘ RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 236 Re 
0 6 1 16 21 22 31 


prodg:31 < (RA)16:31 X (RB)o:15 signed 

tempo;32 < prodg.3 + (RT) 

if ((prodg = RT9) A (RT # tempy)) then (RT) < (RTo|| 31 (=RTo)) 
else (RT) < tempy.30 


The low-order halfword of RA is multiplied by the high-order halfword of RB. The signed product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. 


If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is less 
than -2°', the value stored in RT is —2°". Likewise, if a result is greater than 2°! — 1, the value stored 
in RT is 231 -1. 

Registers Altered 

¢ RT 

© CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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macchwsu 


Multiply Accumulate Cross Halfword to Word Saturate Unsigned 


macchwsu RT, RA, RB OE=0, Rc=0 
macchwsu. ‘RT, RA, RB OE=0, Rc=1 
macchwsuo_ BRT, RA, RB OE=1, Rc=0 
macchwsuo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 204 Re 
0 6 1 16 21 22 31 


prodg.31 <— (RA)16:31 X (RB)o.15 unsigned 

tempo-32 < prodo.31 + (RT) 

(RT) < (tempy.32 V **tempg) 
The low-order halfword of RA is multiplied by the high-order halfword of RB. The unsigned product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. 
If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is greater 
than 292 — 1, the value stored in RT is 29° — 1. 

Registers Altered 

« RT 

: CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-97 


macchwu 
Multiply Accumulate Cross Halfword to Word Modulo Unsigned 


macchwu RT, RA, RB OE=0, Rc=0 
macchwu. RT, RA, RB OE=0, Rc=1 
macchwuo RT, RA, RB OE=1, Rc=0 
macchwuo._ &T, RA, RB OE=1, Rc=1 
4 RT RA RB OE 140 Re 
0 6 1 16 21 22 31 


prodg.31 < (RA)16:31 X (RB)o.15 unsigned 
tempo-32 < prodo.31 + (RT) 
(RT) <— temp} .30 
The low-order halfword of RA is multiplied by the high-order halfword of RB. The unsigned product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. The contents of 
RT are replaced by the low-order 32 bits of the temporary register. 
Registers Altered 
*« RT 
* CRI[CRO].t Gt, Ea, so if Re contains 1 
¢ XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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machhw 
Multiply Accumulate High Halfword to Word Modulo Signed 


machhw RT, RA, RB OE=0, Rc=0 
machhw. RT, RA, RB OE=0, Rc=1 
machhwo RT, RA, RB OE=1, Rc=0 
machhwo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 44 Re 
0 6 11 16 21 22 31 


prodg-31 < (RA)o-15 X (RB)o:15 signed 
tempo;32 < prodg.31 + (RT) 
(RT) <— tempy.30 
The high-order halfword of RA is multiplied by the high-order halfword of RB. The signed product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. The contents of 
RT are replaced by the low-order 32 bits of the temporary register. 
Registers Altered 
« RT 
: CR[CRO]_7, GT, EQ, SO if Rc contains 1 
¢ XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-99 


machhws 
Multiply Accumulate High Halfword to Word Saturate Signed 


machhws RT, RA, RB OE=0, Rc=0 
machhws. RT, RA, RB OE=0, Rc=1 
machhwso RT, RA, RB OE=1, Rc=0 
machhwso. _ RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 108 Re 
0 6 1 16 21 22 31 


prodg:31 < (RA)o:15 X (RB)o.15 signed 

tempo-32 < prodo.31 + (RT) 

if ((prodg = RTg) A (RTg # tempy)) then (RT) < (RT || °1(ARTo)) 
else (RT) < tempy.30 


The high-order halfword of RA is multiplied by the high-order halfword of RB. The signed product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. 


If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is less 
than -2°', the value stored in RT is —2°". Likewise, if a result is greater than 2°! — 1, the value stored 
in RT is 231 -1. 

Registers Altered 

¢ RT 

© CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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machhwsu 
Multiply Accumulate High Halfword to Word Saturate Unsigned 


machhwsu RT, RA, RB OE=0, Rc=0 
machhwsu. RT, RA, RB OE=0, Rc=1 
machhwsuo_ BRT, RA, RB OE=1, Rc=0 
machhwsuo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 76 Re 
0 6 11 16 21 22 31 


prodg-31 < (RA)g-15 x (RB)o.15 unsigned 

tempo-32 < prodo.31 + (RT) 

(RT) < (tempy.32 V **tempo) 
The high-order halfword of RA is multiplied by the high-order halfword of RB. The unsigned product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. 
If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is greater 
than 292 — 1, the value stored in RT is 29° — 1. 

Registers Altered 

« RT 

: CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-101 


machhwu 
Multiply Accumulate High Halfword to Word Modulo Unsigned 


machhwu RT, RA, RB OE=0, Rc=0 
machhwu. RT, RA, RB OE=0, Rc=1 
machhwuo RT, RA, RB OE=1, Rc=0 
machhwuo. ‘BRT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 12 Re 
0 6 11 16 21 22 31 


prodg-31 < (RA)g-15 xX (RB)o.15 unsigned 
tempo-32 < prodo.31 + (RT) 
(RT) <— tempy.32 
The high-order halfword of RA is multiplied by the high-order halfword of RB. The unsigned product is 


summed with the contents of RT and the sum is stored in a 33-bit temporary register. The contents of 
RT are replaced by the low-order 32 bits of the temporary register. 


Registers Altered 
oT 


© CR[CRO]_r, GT, EQ, SO if Rc contains 1 
* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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macihw 
Multiply Accumulate Low Halfword to Word Modulo Signed 


maclhw RT, RA, RB OE=0, Rc=0 
maclhw. RT, RA, RB OE=0, Rc=1 
maclhwo RT, RA, RB OE=1, Rc=0 
maclhwo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 428 Re 
0 6 1 16 21 22 31 


prodg.31 < (RA)16:31 X (RB) 16:31 signed 
temPo.32 < prodo.3 + (RT) 
(RT) <— tempy.30 
The low-order halfword of RA is multiplied by the low-order halfword of RB. The signed product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. The contents of 
RT are replaced by the low-order 32 bits of the temporary register. 
Registers Altered 
« RT 
: CR[CRO]_7, GT, EQ, SO if Rc contains 1 
¢ XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-103 


maclhws 
Multiply Accumulate Low Halfword to Word Saturate Signed 


maclhws RT, RA, RB OE=0, Rc=0 
maclhws. RT, RA, RB OE=0, Rc=1 
maclhwso RT, RA, RB OE=1, Rc=0 
maclhwso. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 492 Re 
0 6 11 16 21 22 31 


prodg-31 < (RA)16:31 X (RB) 16-31 Signed 

temPo:32 < prodo.3 + (RT) 

if ((prodg = RTo) A (RT # tempy)) then (RT) < (RTo|| 31 (=RTo)) 
else (RT) < tempy.30 


The low-order halfword of RA is multiplied by the low-order halfword of RB. The signed product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. 


If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is less 
than -2°', the value stored in RT is —2°". Likewise, if a result is greater than 2°! — 1, the value stored 
in RT is 231 -1. 

Registers Altered 

¢ RT 

© CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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maclhwsu 
Multiply Accumulate Low Halfword to Word Saturate Unsigned 


maclhwsu RT, RA, RB OE=0, Rc=0 
maclhwsu. RT, RA, RB OE=0, Rc=1 
maclhwsuo_ BRT, RA, RB OE=1, Rc=0 
maclhwsuo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 460 Re 
0 6 11 16 21 22 31 


prodg.31 < (RA)16:31 X (RB) 16-31 unsigned 
tempo-32 < prodo.31 + (RT) 
(RT) < (temp;.32 V **tempg) 


The low-order halfword of RA is multiplied by the low-order halfword of RB. The unsigned product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. 


If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is greater 
than 292 — 1, the value stored in RT is 29° — 1. 

Registers Altered 

« RT 

: CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-105 


maclhwu 
Multiply Accumulate Low Halfword to Word Modulo Unsigned 


maclhwu RT, RA, RB OE=0, Rc=0 
maclhwu. RT, RA, RB OE=0, Rc=1 
maclhwuo RT, RA, RB OE=1, Rc=0 
maclhwuo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 396 Re 
0 6 1 16 21 22 31 


prodg-31 < (RA)16:31 X (RB) 16-31 unsigned 
tempo-.32 < prodg.31 + (RT) 
(RT) <— temp} .32 
The low-order halfword of RA is multiplied by the low-order halfword of RB. The unsigned product is 
summed with the contents of RT and the sum is stored in a 33-bit temporary register. The contents of 
RT are replaced by the low-order 32 bits of the temporary register. 
Registers Altered 
*« RT 
© CR[CRO]_r, GT, EQ, SO if Rc contains 1 
¢ XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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merf 
Move Condition Register Field 


merf BF, BFA 
19 BF BFA 0 
0 6 9 11 14 21 31 
m< BFA 
n< BF 


(CR[CRn]) < (CR[CRm}) 


The contents of the CR field specified by the BFA field are placed into the CR field specified by the BF 
field. 


Registers Altered 
¢ CR[CRn] where nis specified by the BF field. 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-107 


mcrxr 
Move to Condition Register from XER 


merxr BF 


31 BF 512 


n< BF 
(CR[CRn]) < XERo-3 
XER ¢:3 < 40 


The contents of XERo-3 are placed into the CR field specified by the BF field. XER9.3 are then set to 0. 


This transfer is positional, by bit number, so the mnemonics associated with each bit are changed. 
See Table 9-18 for clarification. 


Table 9-18. Transfer Bit Mnemonic Assignment 


Bit XER Usage CR Usage 
0 SO LT 
1 OV GT 
CA EQ 
3 Reserved SO 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
¢ CR[CRn] where nis specified by the BF field. 
¢ XER[SO, OV, CA] 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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mfcr 


Move From Condition Register 


mfcr RT 


31 RT 19 


(RT) <— (CR) 
The contents of the CR are placed into register RT. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 
¢ RT 
Invalid Instruction Forms 
¢ Reserved fields 
Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-109 


mfdcr 


Move from Device Control Register 


mfdcr RT, DCRN 


31 RT DCRF 323 


DCRN < DCRF¢5,9 || DCRF9-4 
(RT) <— (DCR(DCRN)) 


The contents of the DCR specified by the DCRF field are placed into register RT. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* RT 

Invalid Instruction Forms 


« Reserved fields 
¢ Invalid DCRF values 


Programming Note 
Execution of this instruction is privileged. 


The DCR number (DCRN) specified in the assembler language coding of mfdcr refers to a DCR 
number. The assembler handles the unusual register number encoding to generate the DCRF field. 


Architecture Note 


This instruction is implementation-specific and may not be portable to other implementations. 
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mfmsr 


Move From Machine State Register 


mfmsr RT 


31 RT 83 


(RT) < (MSR) 
The contents of the MSR are placed into register RT. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 
¢ RT 
Invalid Instruction Forms 
¢ Reserved fields 
Programming Note 
Execution of this instruction is privileged. 
Architecture Note 


This instruction is part of the IBM PowerPC Embedded Operating Environment. 


Instruction Set 9-111 


mfspr 


Move From Special Purpose Register 


mfspr RT, SPRN 


31 RT SPRF 339 


SPRN < SPRF5.9 || SPRFo-4 
(RT) <— (SPR(SPRN)) 


The contents of the SPR specified by the SPRF field are placed into register RT. See “Special 
Purpose Registers” on page 10-2 for a listing of SPR mnemonics and corresponding SPRN and 
SPRF values. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ RT 

Invalid Instruction Forms 

¢ Reserved fields 

¢ Invalid SPRF values 

Programming Note 


Execution of this instruction is privileged if instruction bit 11 contains 1. See “Privileged Mode 
Operation” on page 2-30. 


The SPR number (SPRN) specified in the assembler language coding of mfspr refers to an SPR 
number (see “Special Purpose Registers” on page 10-2 for a list of SPRN values). The assembler 
handles the unusual register number encoding to generate the SPRF field. Also, see “Privileged 
SPRs’ on page 2-32 for information about privileged SPRs. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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31 


Table 9-19. Extended Mnemonics for mfspr 


mfspr 


Move From Special Purpose Register 


Mnemonic 


mfccrO 
mfctr 
mfdac1 
mfdac2 
mfdear 
mfdbcr0 
mfdbcr1 
mfdbsr 
mfdccr 
mfdewr 
mfdvc1 
mfdvc2 
mfesr 
mfevpr 
mfiac1 
mfiac2 
mfiac3 
mfiac4 
mficcr 
mficdbdr 
mfir 
mfpid 
mfpit 
mfpvr 
mfsgr 
mfsler 
mfsprgO 
mfsprg1 
mfsprg2 
mfsprg3 
mfsprg4 
mfsprg5 
mfsprg6 
mfsprg7 
mfsrr0O 
mfsrr1 
mfsrr2 
mfsrr3 
mfsuOr 
mftcr 
mftsr 
mfxer 
mfzpr 


Operands 


RT 


Function 


Move from special purpose register SPRN. 
Extended mnemonic for 
mfspr RT,SPRN 


See “Special Purpose Registers” on page 10-2 
for a list of valid SPRN values. 


Other 
Registers 
Changed 


Instruction Set 


9-113 


mftb 


Move From Time Base 


mftb RT, TBRN 


31 RT TBRF 371 


TBRN < TBRFs5,9 || TBRFo.4 
(RT) <— (TBR(TBRN)) 


The contents of the time base register (TBR) specified by the TBRF field are placed into register RT. 
The following table lists the TBRN and TBRF values. 


Table 9-20. Extended Mnemonics for mftb 


TBRN 
Register 
Mnemonic Register Name Decimal | Hex | TBRF | Access 
TBL Time Base Lower 268 0x10C | 0x188 | Read-only 
TBU Time Base Upper 269 0x10D | 0x1A8 | Read-only 


If TBRN is a value other than those listed in the table, the results are boundedly undefined. 


Registers Altered 
* RT 
Invalid Instruction Forms 


¢« Reserved fields 
¢ Invalid TBRF values 


Programming Notes 


The mnemonic mftb serves as both a hardware mnemonic and an extended mnemonic. The 
assembler recognizes an mftb mnemonic having two operands as the hardware form; an mftb 
mnemonic having one operand is recognized as the extended form. 


The TBR number (TBRN) specified in the assembler language coding of the mftb instruction refers to 
a TBR number listed in the preceding table. The assembler handles the unusual register number 
encoding to generate the TBRF field. 
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Architecture Note 


mftb 


Move From Time Base 


This instruction is part of the IBM PowerPC Embedded Virtual Environment. 


Table 9-21. Extended Mnemonics for mftb 


Other Registers 


Mnemonic | Operands Function Altered 
mftb RT Move the contents of TBL into RT. 

Extended mnemonic for 

mftb RT,TBL 
mftbu RT Move the contents of TBU into RT. 


Extended mnemonic for 
mftb RT,TBU 


Instruction Set 9-115 


micrf 


Move to Condition Register Fields 


mtcrf FXM, RS 


31 RS FXM 144 


0 6 11 12 20 21 31 


mask < 4(FXMg) || 4(FXM4) || .-. | 4(FXMg) Il 4(FXMz7) 
(CR) < ((RS) A mask) v ((CR) A —mask) 


Some or all of the contents of register RS are placed into the CR as specified by the FXM field. 


Each bit in the FXM field controls the copying of 4 bits in register RS into the corresponding bits in the 
CR. The correspondence between the bits in the FXM field and the bit copying operation is shown in 
the following table: 


FXM Bit Bits 
Number Controlled 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* CR 

Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-22. Extended Mnemonics for mtcrf 


Other Registers 
Mnemonic | Operands Function Altered 
mtcr RS Move to CR. 
Extended mnemonic for 
micrf OxFF,RS 
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mtdcr 


Move To Device Control Register 


mtdcr DCRN, RS 


31 RS DCRF 451 


DCRN < DCRFs5,9 || DCRF9-4 
(DCR(DCRN)) <— (RS) 


The contents of register RS are placed into the DCR specified by the DCRF field. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* DCR(DCRN) 


Invalid Instruction Forms 


« Reserved fields 
¢ Invalid DCRF values 


Programming Note 
Execution of this instruction is privileged. 


The DCR number (DCRN) specified in the assembler language coding of mtdcr refers to a DCR 
number. The assembler handles the unusual register number encoding to generate the DCRF field. 


Architecture Note 


This instruction is implementation-specific and may not be portable to other implementations. 


Instruction Set 9-117 


mtmsr 


Move To Machine State Register 


mtmsr RS 


31 RS 146 


(MSR) < (RS) 
The contents of register RS are placed into the MSR. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 
« MSR 
Invalid Instruction Forms 
¢ Reserved fields 
Programming Note 
The mtmsr instruction is privileged and execution synchronizing. 
Architecture Note 


This instruction is part of the IBM PowerPC Embedded Operating Environment. 
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mtspr 


Move To Special Purpose Register 


mtspr SPRN, RS 


31 RS SPRF 467 


SPRN < SPRF5.9 || SPRFo-4 
(SPR(SPRN)) <— (RS) 


The contents of register RS are placed into register RT. See “Special Purpose Registers” on 
page 10-2 for a listing of SPR mnemonics and corresponding SPRN and SPRF values. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 
* SPR(SPRN) 


Invalid Instruction Forms 


¢« Reserved fields 
¢ Invalid SPRF values 


Programming Note 


Execution of this instruction is privileged if instruction bit 11 is a 1. See “Privileged SPRs” on 
page 2-32 for more information. 


The SPR number (SPRN) specified in the assembler language coding of the mtspr instruction refers 
to an SPR number (see “Special Purpose Registers” on page 10-2 for a list of SPRN values). The 
assembler handles the unusual register number encoding to generate the SPRF field. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-119 


mtspr 


Move To Special Purpose Register 


Table 9-23. Extended Mnemonics for mtspr 


Mnemonic 


mtccr0O 
mtctr 
mtdac1 
mtdac2 
mtdbcr0 
mtdbcr1 
mtdbsr 
mtdccr 
mtdewr 
mtdear 
mtdvc1 
mtdvc2 
mtesr 
mtevpr 
mtiac1 
mtiac2 
mtiac3 
mtiac4 
mticcr 
mticdbdr 
miir 
mtpid 
mtpit 
mipvr 
mtsgr 
mtsler 
mtsprgO 
mtsprg1 
mtsprg2 
mtsprg3 
mtsprg4 
mtsprg5 
mtsprg6 
mtsprg7 
mtsrr0 
mtsrr1 
mitsrr2 
mtsrr3 
mtsuOr 
mttcr 
mttsr 
mtxer 
mizpr 


Operands 


RS 


Function 


Move to special purpose register SPRN. 
Extended mnemonic for 
mtspr SPRN,RS 


See “Special Purpose Registers” on page 10-2 
for a list of valid SPRN values. 


Other Registers 
Altered 


9-120 
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mulchw 
Multiply Cross Halfword to Word Signed 


mulchw RT, RA, RB Rc=0 
mulchw. RT, RA, RB Rc=1 

4 RT RA RB 168 Re 
0 6 11 16 21 31 


(RT)0:31 <— (RA)16:31 X (RB)o-15 signed 
The low-order halfword of RA is multiplied by the high-order halfword of RB. The resulting signed 
product replaces the contents of RT. 
Registers Altered 
¢ RT 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-121 


mulchwu 
Multiply Cross Halfword to Word Unsigned 


mulchwu RT, RA, RB Rc=0 
mulchwu. RT, RA, RB Rc=1 

4 RT RA RB 136 Re 
0 6 11 16 21 31 


(RT)0:31 <— (RA) 16:31 X (RB)o:15 unsigned 
The low-order halfword of RA is multiplied by the high-order halfword of RB. The resulting unsigned 
product replaces the contents of RT. 
Registers Altered 
¢ RT 
bs CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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mulhhw 
Multiply High Halfword to Word Signed 


mulhhw RT, RA, RB Rc=0 
mulhhw. RT, RA, RB Rc=1 

4 RT RA RB 40 Re 
0 6 11 16 24 31 


(RT)0:31 <— (RA)o-15 X (RB)o-15 signed 
The high-order halfword of RA is multiplied by the high-order halfword of RB. The resulting signed 
product replaces the contents of RT. 
Registers Altered 
¢ RT 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-123 


mulhhwu 
Multiply High Halfword to Word Unsigned 


mulhhwu RT, RA, RB Rc=0 
mulhhwu. RT, RA, RB Rc=1 

4 RT RA RB 8 Re 
0 6 11 16 21 31 


(RT)0:31 <— (RA)o-15 X (RB)o-15 unsigned 
The high-order halfword of RA is multiplied by the high-order halfword of RB. The resulting unsigned 
product replaces the contents of RT. 
Registers Altered 
¢ RT 
bs CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


9-124 PPC405 Core User’s Manual 


mulhw 
Multiply High Word 


mulhw RT, RA, RB Rc=0 
mulhw. RT, RA, RB Re=1 

31 RT RA RB 75 Re 
0 6 ih 16 21 22 31 


prodg.g3 <— (RA) x (RB) signed 
(RT) — prodo-34 


The 64-bit signed product of registers RA and RB is formed. The most significant 32 bits of the result 
is placed into register RT. 


Registers Altered 

¢ RT 

© CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Programming Note 


The most significant 32 bits of the product, unlike the least significant 32 bits, may differ depending on 
whether the registers RA and RB are interpreted as signed or unsigned quantities. mulhw generates 
the correct result when these operands are interpreted as signed quantities. mulhwu generates the 
correct result when these operands are interpreted as unsigned quantities. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-125 


mulhwu 
Multiply High Word Unsigned 


mulhwu RT, RA, RB Rc=0 
mulhwu. RT, RA, RB Rc=1 

31 RT RA RB 11 Re 
0 6 11 16 21 31 


prodg.g3 <— (RA) x (RB) unsigned 
(RT) a prodo-34 


The 64-bit unsigned product of registers RA and RB is formed. The most significant 32 bits of the 
result are placed into register RT. 

Registers Altered 

¢ RT 

® CR[CRO]_7, GT, EQ, SO if Rc contains 1 

Programming Note 


The most significant 32 bits of the product, unlike the least significant 32 bits, may differ depending on 
whether the registers RA and RB are interpreted as signed or unsigned quantities. The mulhw 
instruction generates the correct result when these operands are interpreted as signed quantities. 
The mulhwu instruction generates the correct result when these operands are interpreted as 
unsigned quantities. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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mullhw 
Multiply Low Halfword to Word Signed 


mullhw RT, RA, RB Rc=0 
mullhw. RT, RA, RB Re=1 

4 RT RA RB 424 Re 
0 6 11 16 21 31 


(RT)0:31 <— (RA) 16:31 X (RB)16:31 Signed 
The low-order halfword of RA is multiplied by the low-order halfword of RB. The resulting signed 
product replaces the contents of RT. 
Registers Altered 
¢ RT 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-127 


mullhwu 
Multiply Low Halfword to Word Unsigned 


mullhwu RT, RA, RB OE=0, Rc=0 
mullhwu. RT, RA, RB OE=0, Rc=1 

4 RT RA RB 392 Rc 
0 6 11 16 21 31 


(RT)0:31 < (RA) 16:31 X (RB)16.31 unsigned 
The low-order halfword of RA is multiplied by the low-order halfword of RB. The resulting unsigned 
product replaces the contents of RT. 
Registers Altered 
¢ RT 
bs CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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mulli 


Multiply Low Immediate 


mulli RT, RA, IM 


prodg.47 <— (RA) x EXTS(IM) signed 
(RT) <— prod4g.47 


The 48-bit product of register RA and the sign-extended IM field is formed. Both register RA and the 
IM field are interpreted as signed quantities. The least significant 32 bits of the product are placed into 
register RT. 


Registers Altered 
¢ RT 
Programming Note 


The least significant 32 bits of the product are correct, regardless of whether register RA and field IM 
are interpreted as signed or unsigned numbers. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-129 


mullw 
Multiply Low Word 


mullw RT, RA, RB OE=0, Rc=0 
mullw. RT, RA, RB OE=0, Rc=1 
mullwo RT, RA, RB OE=1, Rc=0 
mullwo. RT, RA, RB OE=1, Rc=1 
31 RT RA RB OE 235 Re 
0 6 ih 16 21 22 31 


prodg.g3 <— (RA) x (RB) signed 
(RT) <— prodgo-63 


The 64-bit signed product of register RA and register RB is formed. The least significant 32 bits of the 
result is placed into register RT. 


If the signed product cannot be represented in 32 bits and OE=1, XER[SO, OV] are set to 1. 
Registers Altered 

¢ RT 

° CR[CRO]_r, GT, EQ, SO if Rc contains 1 

¢ XER[SO, OV] if OE=1 

Programming Note 


The least significant 32 bits of the product are correct, regardless of whether register RA and register 
RB are interpreted as signed or unsigned numbers. The overflow indication is correct only if the 
operands are regarded as signed numbers. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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nand 


NAND 
nand RA, RS, RB Rc=0 
nand. RA, RS, RB Rce=1 
31 RT RA RB 476 Re 
0 6 11 16 21 31 


(RA) <— —((RS) A (RB)) 


The contents of register RS is ANDed with the contents of register RB; the ones complement of the 
result is placed into register RA. 


Registers Altered 
* RA 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-131 


neg 


Negate 
neg RT, RA OE=0, Rc=0 
neg. RT, RA OE=0, Rce=1 
nego RT, RA OE=1, Rc=0 
nego. RT, RA OE=1, Rc=1 
31 RT RA OE 104 Re 
0 6 11 16 21 22 31 


(RT) < —(RA) + 1 
The twos complement of the contents of register RA are placed into register RT. 
Registers Altered 
¢ RT 
° CR[CRO], +. GT, EQ, SO if Rc contains 1 
¢ XER[SO, OV] if OE=1 
Invalid Instruction Forms 
¢ Reserved fields 
Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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nmacchw 


Negative Multiply Accumulate Cross Halfword to Word Modulo Signed 


nmacchw RT, RA, RB OE=0, Rc=0 
nmacchw. RT, RA, RB OE=0, Rc=1 
nmacchwo RT, RA, RB OE=1, Rc=0 
nmacchwo.__ RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 174 Re 
0 6 11 16 21 22 31 


nprodg.31 < —((RA) 16-31 X (RB)o-15) signed 
tempo:32 < Nprodg-31 + (RT) 
(RT) <— tempy.32 
The low-order halfword of RA is multiplied by the high-order halfword of RB. The negated signed 


product is summed with the contents of RT and the sum is stored in a 33-bit temporary register. The 
contents of RT are replaced by the low-order 32 bits of the temporary register. 


Registers Altered 
¢ RT 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-133 


nmacchws 
Negative Multiply Accumulate Cross Halfword to Word Saturate Signed 


nmacchws RT, RA, RB OE=0, Rc=0 
nmacchws. _ ‘RT, RA, RB OE=0, Rc=1 
nmacchwso_ BRT, RA, RB OE=1, Rc=0 
nmacchwso. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 238 Re 
0 6 1 16 21 22 31 


nprodg.31 < —((RA)16:31 X (RB)o-15 signed 

temPo.32 < Nprodg,3; + (RT) 

if ((nprodg = RTp) A (RT # temp,)) then (RT) < (RT9|| 3'(4RT9)) 
else (RT) < tempy.30 


The low-order halfword of RA is multiplied by the high-order halfword of RB. The negated signed 
product is summed with the contents of RT and the sum is stored in a 33-bit temporary register. 


If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is less 
than -2°', the value stored in RT is —2°". Likewise, if a result is greater than 2°! — 1, the value stored 
in RT is 231 -1. 

Registers Altered 

¢ RT 

© CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


9-134 PPC405 Core User’s Manual 


nmachhw 


Negative Multiply Accumulate High Halfword to Word Modulo Signed 


nmachhw RT, RA, RB OE=0, Rc=0 
nmachhw. RT, RA, RB OE=0, Rc=1 
nmachhwo RT, RA, RB OE=1, Rc=0 
nmachhwo._ BRT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 46 Re 
0 6 1 16 21 22 31 


nprodg.31 < —((RA)o-15 X (RB)o-15) signed 
tempo-32 < Nprodg.31 + (RT) 
(RT) <— tempy.32 
The high-order halfword of RA is multiplied by the high-order halfword of RB. The negated signed 


product is summed with the contents of RT and the sum is stored in a 33-bit temporary register. The 
contents of RT are replaced by the low-order 32 bits of the temporary register. 


Registers Altered 
¢ RT 


: CR[CRO]_7, GT, EQ, SO if Rc contains 1 
* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-135 


nmachhws 
Negative Multiply Accumulate High Halfword to Word Saturate Signed 


nmachhws RT, RA, RB OE=0, Rc=0 
nmachhws. RT, RA, RB OE=0, Rc=1 
nmachhwso_ BT, RA, RB OE=1, Rc=0 
nmachhwso. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 110 Re 
0 6 11 16 21 22 31 


nprodg.31 < —((RA)o:15 X (RB)o.15) signed 

temPo.32 <— Nprodg,3; + (RT) 

if ((nprodg = RTp) A (RT # temp,)) then (RT) < (RT9|I 3'(4RT9)) 
else (RT) < tempy.30 


The high-order halfword of RA is multiplied by the high-order halfword of RB. The negated signed 
product is summed with the contents of RT and the sum is stored in a 33-bit temporary register. 


If a result does not overflow (i.e., it is accurately representable in 32 bits), the low-order 32 bits of the 
temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is less 
than —2°', the value stored in RT is —2°". Likewise, if a result is greater than 2°! — 1, the value stored 
in RT is 291 -1. 

Registers Altered 

¢ RT 

bd CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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nmaclhw 
Negative Multiply Accumulate Low Halfword to Word Modulo Signed 


nmaclhw RT, RA, RB OE=0, Rc=0 
nmaclhw. RT, RA, RB OE=0, Rc=1 
nmaclhwo RT, RA, RB OE=1, Rc=0 
nmachliwo. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 430 Re 
0 6 11 16 21 22 31 


nprodo-31 < —((RA) 16-31 X (RB) 16:31) signed 
tempo;32 <— nprodg;3; + (RT) 
(RT) <— tempy.30 
The low-order halfword of RA is multiplied by the low-order halfword of RB. The negated signed 


product is summed with the contents of RT and the sum is stored in a 33-bit temporary register. The 
contents of RT are replaced by the low-order 32 bits of the temporary register. 


Registers Altered 
¢ RT 


: CR[CRO]_7, GT, EQ, SO if Rc contains 1 
* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 


Instruction Set 9-137 


nmaclhws 
Negative Multiply Accumulate High Halfword to Word Saturate Signed 


nmaclhws RT, RA, RB OE=0, Rc=0 
nmaclhws. RT, RA, RB OE=0, Rc=1 
nmaclhwso_ RT, RA, RB OE=1, Rc=0 
nmachiwso. RT, RA, RB OE=1, Rc=1 
4 RT RA RB OE 494 Re 
0 6 11 16 21 22 31 


nprodo.31 < —((RA)416.31 x (RB) 16:31) Signed 

tempo;32 <— nprodg;3; + (RT) 

if ((nprodg = RTp) A (RT # temp,)) then (RT) < (RTg|I 3"(4RT9)) 
else (RT) < tempy.30 


The low-order halfword of RA is multiplied by the low-order halfword of RB. The negated signed 
product is summed with the contents of RT and the sum is stored in a 33-bit temporary register. 


If a result does not overflow, the low-order 32 bits of the temporary register are stored in RT. 


If a result overflows, the returned result is the nearest representable value. Thus, if a result is less 
than -2°', the value stored in RT is —2°". Likewise, if a result is greater than 2°! — 1, the value stored 
in RT is 231 -1. 

Registers Altered 

¢ RT 

© CR[CRO]_r, GT, EQ, SO if Rc contains 1 

* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the Multiply-Accumulate instruction set extensions and complies with the 
architectural requirements for APUs of the IBM PowerPC Embedded Environment. As such, it is not 
part of the PowerPC Architecture, nor is it part of the IBM PowerPC Embedded Environment. 
Programs that use this instruction may not be portable to other implementations. 
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nor 


NOR 
nor RA, RS, RB Rc=0 
nor. RA, RS, RB Rc=1 
31 RT RA RB 124 Re 
0 6 11 16 21 31 


(RA) <— —((RS) v (RB)) 


The contents of register RS is ORed with the contents of register RB; the ones complement of the 
result is placed into register RA. 


Registers Altered 
* RA 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-24. Extended Mnemonics for nor, nor. 


Other Registers 
Mnemonic | Operands Function Altered 
RA, RS Complement register. 
(RA) < —(RS) 

Extended mnemonic for 
not nor RA,RS,RS 

Extended mnemonic for CR[CRO] 
not. nor. RA,RS,RS 


Instruction Set 9-139 


or 


OR 
or RA, RS, RB Rc=0 
or. RA, RS, RB Re=1 
31 RS RA RB 444 Re 
0) 6 11 16 21 31 


(RA) <— (RS) v (RB) 


The contents of register RS is ORed with the contents of register RB; the result is placed into register 
RA. 


Registers Altered 
* RA 
be CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-25. Extended Mnemonics for or, or. 


Other Registers 
Mnemonic | Operands Function Altered 
mr RT, RS Move register. 
(RT) < (RS) 

Extended mnemonic for 

or RT,RS,RS 
mr. Extended mnemonic for CR[CRO] 

or. RT,RS,RS 
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orc 
OR with Complement 


orc RA, RS, RB Rc=0 
orc. RA, RS, RB Re=1 

31 RT RA RB 412 Re 
0) 6 11 16 21 31 


(RA) < (RS) v —(RB) 


The contents of register RS is ORed with the ones complement of the contents of register RB; the 
result is placed into register RA. 


Registers Altered 
* RA 
: CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-141 


ori 


OR Immediate 


ori RA, RS, IM 


24 RS RA IM 


(RA) <— (RS) v (‘80 |j IM) 


The IM field is extended to 32 bits by concatenating 16 0-bits on the left. Register RS is ORed with the 
extended IM field; the result is placed into register RA. 


Registers Altered 
* RA 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-26. Extended Mnemonics for ori 


Other Registers 
Mnemonic | Operands Function Changed 
nop Preferred no-op; triggers optimizations based on 
no-ops. 
Extended mnemonic for 
ori 0,0,0 
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oris 
OR Immediate Shifted 


oris RA, RS, IM 


25 RS RA IM 


(RA) <— (RS) v (IM || 190) 


The IM Field is extended to 32 bits by concatenating 16 O-bits on the right. Register RS is ORed with 
the extended IM field and the result is placed into register RA. 


Registers Altered 
* RA 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-143 


rfci 


Return From Critical Interrupt 


rfci 


19 51 


(PC) < (SRR2) 
(MSR) <— (SRR3) 


The program counter (PC) is restored with the contents of SRR2 and the MSR is restored with the 
contents of SRR3. 


Instruction execution returns to the address contained in the PC. 


Registers Altered 
* MSR 


Programming Note 
Execution of this instruction is privileged and context-synchronizing. 
Architecture Note 


This instruction part of the IBM PowerPC Embedded Operating Environment. 
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rfi 


Return From Interrupt 


rfi 


19 50 


(PC) < (SRRO) 
(MSR) <— (SRR1) 


The program counter (PC) is restored with the contents of SRRO and the MSR is restored with the 
contents of SRR1. 


Instruction execution returns to the address contained in the PC. 


Registers Altered 
* MSR 


Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 

Execution of this instruction is privileged and context-synchronizing. 
Architecture Note 


This instruction is part of the IBM PowerPC Embedded Operating Environment. 


Instruction Set 9-145 


rlwimi 


Rotate Left Word Immediate then Mask Insert 


rlwimi RA, RS, SH, MB, ME Rc=0 
rlwimi. RA, RS, SH, MB, ME Re=1 
20 RS RA SH MB ME Re 
0 6 ih 16 21 26 31 


r <— ROTL((RS), SH) 
m < MASK(MB, ME) 
(RA) < (rA m) v ((RA) A =m) 


The contents of register RS are rotated left by the number of bit positions specified in the SH field. A 
mask is generated, having 1-bits starting at the bit position specified in the MB field and ending in the 
bit position specified by the ME field, with 0-bits elsewhere. 


If the starting point of the mask is at a higher bit position than the ending point, the 1-bits portion of 
the mask wraps from the highest bit position back around to the lowest. The rotated data is inserted 
into register RA, in positions corresponding to the bit positions in the mask that contain a 1-bit. 


Registers Altered 
* RA 
© CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-27. Extended Mnemonics for rlwimi, rlwimi. 


Other Registers 
Mnemonic | Operands Function Altered 


inslwi RA, RS, n, b | Insert from left immediate (n > 0). 
(RA)p:b+n-1 << (RS)o:n-1 
Extended mnemonic for 
rlwimi RA,RS,32-b,b,b+n-1 


inslwi. Extended mnemonic for CR[CRO] 
rlwimi. RA,RS,32—b,b,b+n-1 


insrwi RA, RS, n,b | Insert from right immediate. (n > 0) 
(RA)p:b+n-1 < (RS)39-n:31 
Extended mnemonic for 
rlwimi RA,RS,32—b-n,b,b+n-1 


insrwi. Extended mnemonic for CR[CRO] 
rlwimi. RA,RS,32—b—n,b,b+n-1 
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rlwinm 
Rotate Left Word Immediate then AND with Mask 


rlwinm RA, RS, SH, MB, ME Rc=0 
rlwinm. RA, RS, SH, MB, ME Re=1 

21 RS RA SH MB ME Re 
0 6 11 16 21 26 31 


r < ROTL((RS), SH) 
m < MASK(MB, ME) 
(RA) — ram 


The contents of register RS are rotated left by the number of bit positions specified in the SH field. A 
mask is generated, having 1-bits starting at the bit position specified in the MB field and ending in the 
bit position specified by the ME field with 0-bits elsewhere. 


If the starting point of the mask is at a higher bit position than the ending point, the 1-bits portion of 
the mask wraps from the highest bit position back around to the lowest. The rotated data is ANDed 
with the generated mask; the result is placed into register RA. 


Registers Altered 
* RA 
. CR[CRO]_7, GT, EQ, SO if Rc contains 1 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-28. Extended Mnemonics for rlwinm, rlwinm. 


Other Registers 
Mnemonic | Operands Function Altered 


clrlwi RA, RS, n Clear left immediate. (n < 32) 
(RA)o:n-1 <— 0 
Extended mnemonic for 
rlwinm RA,RS,0,n,31 


clrlwi. Extended mnemonic for CR[CRO] 
rlwinm. RA,RS,0,n,31 
clrislwi RA, RS, b,n | Clear left and shift left immediate. 
(n<b< 832) 


A)o:b-n-1 < "0 
Extended mnemonic for 
rlwinm RA,RS,n,b-n,31—n 


clrlslwi. Extended mnemonic for CR[CRO] 
rlwinm. RA,RS,n,b—n,31—n 


Instruction Set 9-147 


rlwinm 


Rotate Left Word Immediate then AND with Mask 


Table 9-28. Extended Mnemonics for rlwinm, rlwinm. (continued) 


Mnemonic | Operands 


clrrwi RA, RS, n 


clrrwi. 


Function 


Clear right immediate. (n < 32) 

(RA)32-n:31 <— "0 

Extended mnemonic for 
rlwinm RA,RS,0,0,31—n 


Other Registers 
Altered 


Extended mnemonic for 
rlwinm. RA,RS,0,0,31—n 


CR[CRO] 


extlwi RA, RS, n, b 


extlwi. 


Extract and left justify immediate. (n > 0) 
(RA)o:n-1 << (RS)p:bsn-1 
(RA)n:31 <— "0 

Extended mnemonic for 

rlwinm RA,RS,b,0,n-1 


Extended mnemonic for 
rlwinm. RA,RS,b,0,n-1 


CR[CRO] 


extrwi RA, RS, n, b 


extrwi. 


Extract and right justify immediate. (n > 0) 
(RA)32-n:31 << (RS)b-ban-1 
(RA)o:31-n <— °?"0 

Extended mnemonic for 

rlwinm RA,RS,b+n,32-n,31 


Extended mnemonic for 
rlwinm. RA,RS,b+n,32-n,31 


CR[CRO] 


rotlwi RA, RS, n 


rotlwi. 


Rotate left immediate. 

(RA) < ROTL((RS), n) 
Extended mnemonic for 
rlwinm RA,RS§S,n,0,31 


Extended mnemonic for 
rlwinm. RA,RS,n,0,31 


CR[CRO] 


rotrwi RA, RS, n 


rotrwi. 


Rotate right immediate. 
(RA) < ROTL((RS), 32—-n) 
Extended mnemonic for 
rlwinm RA,RS,32-n,0,31 


Extended mnemonic for 
rlwinm. RA,RS,32-n,0,31 


CR[CRO] 


slwi RA, RS, n 


slwi. 


Shift left immediate. (n < 32) 
(RA)o:31-n — (RS)n:31 
(RA)32-n:31 <— " 
Extended mnemonic for 
rlwinm RA,RS,n,0,31—n 


Extended mnemonic for 
rlwinm. RA,RS,n,0,31—n 


CR[CRO] 
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rlwinm 
Rotate Left Word Immediate then AND with Mask 


Table 9-28. Extended Mnemonics for rlwinm, rlwinm. (continued) 


Other Registers 


Mnemonic | Operands Function Altered 
srwi RA, RS, n Shift right immediate. (n < 32) 

(RA)n:31 — (RS)o:31-n 

(RA)o:n-1 << " 


Extended mnemonic for 
rlwinm RA,RS,32-n,n,31 


srwi. Extended mnemonic for CR[CRO] 
rlwinm. RA,RS,32-n,n,31 


Instruction Set 9-149 


rlwnm 
Rotate Left Word then AND with Mask 


rlwnm RA, RS, RB, MB, ME Rc=0 
rlwnm. RA, RS, RB, MB, ME Re=1 

23 RS RA RB MB ME Rc 
0 6 11 16 21 26 31 


r < ROTL((RS), (RB)97-34) 
m < MASK(MB, ME) 
(RA) — ram 


The contents of register RS are rotated left by the number of bit positions specified by the contents of 
register RBo7.3;. A mask is generated, having 1-bits starting at the bit position specified in the MB 
field and ending in the bit position specified by the ME field with 0-bits elsewhere. 


If the starting point of the mask is at a higher bit position than the ending point, the ones portion of the 
mask wraps from the highest bit position back to the lowest. The rotated data is ANDed with the 
generated mask and the result is placed into register RA. 


Registers Altered 
* RA 
© CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 
This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-29. Extended Mnemonics for rlwnm, rlwnm. 


Other Registers 
Mnemonic | Operands Function Altered 


rotlw RA, RS, RB Rotate left. 

(RA) < ROTL((RS), (RB)97-31) 
Extended mnemonic for 
rlwnm RA,RS,RB,0,31 


rotlw. Extended mnemonic for CR[CRO] 
rlwnm. RA,RS,RB,0,31 
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sc 


Sc 
System Call 


17 


(SRR1) < (MSR) 

(SRRO) < (PC) 

PC <— EVPRo-15 || 0x0C00 
(MSRIWE, EE, PR, DR, IR]) < 0 


A system call exception is generated. The contents of the MSR are copied into SRR1 and 


(4 + address of sc instruction) is placed into SRRO. 


30 31 


The program counter (PC) is then loaded with the exception vector address. The exception vector 
address is calculated by concatenating the high halfword of the Exception Vector Prefix Register 


(EVPR) to the left of Ox0CO00. 

The MSR[WE, EE, PR, DR, IR] bits are set to 0. 

Program execution continues at the new address in the PC. 
The sc instruction is context synchronizing. 


Registers Altered 


* SRRO 
* SRRI1 
* MSR[WE, EE, PR, DR, IR] 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 


9-151 


slw 
Shift Left Word 


slw RA, RS, RB Rc=0 
slw. RA, RS, RB Re=1 

31 RS RB 24 Re 
0 6 ih 16 21 31 


n <— (RB)97-31 
r <— ROTL((RS), n) 
if (RB)og = 0 then 
m < MASK(0, 31 —n) 
else 
m < 80 
(RA) <— ram 


The contents of register RS are shifted left by the number of bits specified by the contents of register 
RBo7.31. Bits shifted left out of the most significant bit are lost, and 0-bits fill vacated bit positions on 


the right. The result is placed into register RA. 


If RBog = 1, register RA is set to zero. 


Registers Altered 
* RA 


° CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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sraw 
Shift Right Algebraic Word 


sraw RA, RS, RB Rc=0 
sraw. RA, RS, RB Rc=1 

31 RS RA RB 792 Re 
0 6 11 16 21 31 


n <— (RB)o7-31 
r < ROTL((RS), 32 —n) 
if (RB)og = 0 then 

m <— MASK(n, 31) 


(RA) < (r A m) v (s A =m) 
XER[CA] < s A ((r A —m) £0) 


The contents of register RS are shifted right by the number of bits specified the contents of register 
RBo7.31. Bits shifted out of the least significant bit are lost. Register RSg is replicated to fill the vacated 
positions on the left. The result is placed into register RA. 


If register RS contains a negative number and any 1-bits were shifted out of the least significant bit 
position, XER[CA] is set to 1; otherwise, it is set to 0. 


If bit 26 of register RB contains 1, register RA and XER[CA] are set to bit 0 of register RS. 
Registers Altered 

* RA 

* XER[CA] 

: CR[CRO]_r, GT, EQ, SO if Rc contains 1 

Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-153 


srawi 
Shift Right Algebraic Word Immediate 


srawi RA, RS, SH Rc=0 
srawi. RA, RS, SH Rc=1 
31 RS RA SH 824 Re 
0 6 11 16 21 31 
n <— SH 


r < ROTL((RS), 32—n) 

m <— MASK(n, 31) 

s < (RS)o 

(RA) < (r A m) v (s A =m) 
XER[CA] < s A ((r A —m)#0) 


The contents of register RS are shifted right by the number of bits specified in the SH field. Bits 
shifted out of the least significant bit are lost. Bit RSo is replicated to fill the vacated positions on the 
left. The result is placed into register RA. 


If register RS contains a negative number and any 1-bits were shifted out of the least significant bit 
position, XER[CA] is set to 1; otherwise, it is set to 0. 


Registers Altered 

° RA 

* XER[CA] 

: CR[CRO]_r, GT, EQ, SO if Rc contains 1 
Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Srw 
Shift Right Word 


srw RA, RS, RB Rc=0 
srw. RA, RS, RB Rc=1 

31 RS RA RB 536 Re 
0 6 11 16 21 31 


n <— (RB)97-31 
r — ROTL((RS), 32 —1n) 
if (RB)og = 0 then 

m < MASK(n, 31) 
else 

m < 0 
(RA) —raAm 


The contents of register RS are shifted right by the number of bits specified the contents of register 
RBo7.31. Bits shifted right out of the least significant bit are lost, and 0-bits fill the vacated bit positions 
on the left. The result is placed into register RA. 


If bit 26 of register RB contains a one, register RA is set to 0. 


Registers Altered 
* RA 
bs CR[CRO]_r, GT, EQ, SO if Rc contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-155 


stb 


Store Byte 
stb RS, D(RA) 
38 RS RA D 
0 6 11 16 31 


EA < (RA|O) + EXTS(D) 
MS(EA, 1) <— (RS)o4.34 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 when the RA field is 0, 
and is the contents of register RA otherwise. 


The least significant byte of register RS is stored into the byte at the EA. 


Registers Altered 


« None 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


9-156 PPC405 Core User’s Manual 


stbu 


Store Byte with Update 


stbu RS, D(RA) 


39 RS RA D 


EA < (RA) + EXTS(D) 
MS(EA, 1) <— (RS)o4-34 
(RA) < EA 


An effective address (EA) is formed by adding a displacement to the base address in register RA. The 
displacement is obtained by sign-extending the 16-bit D field to 32 bits. The EA is placed into register 
RA. 


The least significant byte of register RS is stored into the byte at the EA. 


Registers Altered 
* RA 


Invalid Instruction Forms 
RA =0 
Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-157 


stbux 
Store Byte with Update Indexed 


stbux RS, RA, RB 


31 RS RA RB 247 


EA < (RA) + (RB) 
MS(EA, 1) < (RS)p4-31 
(RA) < EA 


An effective address (EA) is formed by adding an index to the base address in register RA. The index 
is the contents of register RB. The EA is placed into register RA. 


The least significant byte of register RS is stored into the byte at the EA. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

« RA 


Invalid Instruction Forms 


« Reserved fields 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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stbx 


Store Byte Indexed 


stbx RS, RA, RB 


31 RS RA RB 215 


EA < (RA\O) + (RB) 
MS(EA, 1) <— (RS)o4:31 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 when the RA field is 0, and is the contents of register RA 
otherwise. 


The least significant byte of register RS is stored into the byte at the EA. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-159 


sth 


Store Halfword 


sth RS, D(RA) 


EA < (RA\0) + EXTS(D) 
MS(EA, 2) <— (RS)16-34 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 when the RA field is 0 
and is the contents of register RA otherwise. 


The least significant halfword of register RS is stored into the halfword at the EA in main storage. 


Registers Altered 


« None 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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sthbrx 


Store Halfword Byte-Reverse Indexed 


sthbrx RS, RA, RB 


31 RS RA RB 918 


EA < (RA\O) + (RB) 
MS(EA, 2) <— (RS)o4:31 Il (RS)16:23 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 when the RA field is 0, and is the contents of register RA 
otherwise. 


The least significant halfword of register RS is byte-reversed. The result is stored into the halfword at 
the EA. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
* None 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-161 


sthu 
Store Halfword with Update 


sthu RS, D(RA) 


EA < (RA) + EXTS(D) 
MS(EA, 2) < (RS)16:31 
(RA) < EA 


An effective address (EA) is formed by adding a displacement to the base address in register RA. The 
displacement is obtained by sign-extending the 16-bit D field to 32 bits. The EA is placed into register 
RA. 


The least significant halfword of register RS is stored into the halfword at the EA. 


Registers Altered 
*« RA 


Invalid Instruction Forms 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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sthux 
Store Halfword with Update Indexed 


sthux RS, RA, RB 


31 RS RA RB 439 


EA < (RA) + (RB) 
MS(EA, 2) < (RS)16:31 
(RA) — EA 


An effective address (EA) is formed by adding an index to the base address in register RA. The index 
is the contents of register RB. The EA is placed into register RA. 


The least significant halfword of register RS is stored into the halfword at the EA. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

« RA 

Invalid Instruction Forms 


« Reserved fields 
« RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-163 


sthx 


Store Halfword Indexed 


sthx RS, RA, RB 


31 RS RA RB 407 


EA < (RAO) + (RB) 
MS(EA, 2) < (RS)16:31 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 when the RA field is 0, and is the contents of register RA 
otherwise. 


The least significant halfword of register RS is stored into the halfword at the EA. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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stmw 
Store Multiple Word 


stmw RS, D(RA) 


47 RS RA D 


EA < (RA|0) + EXTS(D) 
r<— RS 
do while r < 31 
MS(EA, 4) <— (GPR(r)) 
rer+1 
EA ¢« EA + 4 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 when the RA field is 0, 
and is the contents of register RA otherwise. 


The contents of a series of consecutive registers, starting with register RS and continuing through 
GPR(31), are stored into consecutive words starting at the EA. 


Registers Altered 


« None 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-165 


stswi 
Store String Word Immediate 


stswi RS, RA, NB 


31 RS RA NB 725 


EA < (RAO) 
if NB = Othen 
n€ 32 
else 
n <— NB 
r< RS - 1 
ic O 
do while n > 0 
if i = O then 
rer+1 
if r = 32 then 
r<o0 
MS(EA,1) <— (GPR(?)i.7) 
ic i+ 8 
if i = 32 then 
ic O 
EA < EA + 1 
nen-1 


An effective address (EA) is determined by the RA field. If the RA field contains 0, the EA is 0; 
otherwise, the EA is the contents of register RA. 


A byte count is determined by the NB field. If the NB field contains 0, the byte count is 32; otherwise, 
the byte count is the contents of the NB field. 


The contents of a series of consecutive GPRs (starting with register RS, continuing through GPR(31), 
wrapping to GPR(0O), and continuing to the final byte count) are stored, starting at the EA. The bytes in 
each GPR are accessed starting with the most significant byte. The byte count determines the 
number of transferred bytes. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


« None 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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stswx 
Store String Word Indexed 


stswx RS, RA, RB 


31 RS RA RB 661 


EA < (RA|O) + (RB) 
n < XER[TBC] 
r< RS —- 1 
ic O 
do while n > 0 
if i = O then 
rer+1 
if r = 32 then 
r<0 
MS(EA, 1) <— (GPR(1):i.7) 
ic i+ 8 
if i = 32 then 
ic O 
EA < EA + 1 
nen-1 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 when the RA field is 0, and is the contents of register RA 
otherwise. 


A byte count is contained in XER[TBC]. 


The contents of a series of consecutive GPRs (starting with register RS, continuing through GPR(31), 
wrapping to GPR(0O), and continuing to the final byte count) are stored, starting at the EA. The bytes in 
each GPR are accessed starting with the most significant byte. The byte count determines the 
number of transferred bytes. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 

If XER[TBC] = 0, stswx is treated as a no-op. 


The PowerPC Architecture states that if XER[TBC] = 0 and if the EA is such that a precise data 
exception would normally occur (if not for the zero length), stswx is treated as a no-op and the 
precise exception will not occur. Data storage exceptions and alignment exceptions are examples of 
precise data exceptions. 


Instruction Set 9-167 


stswx 
Store String Word Indexed 


However, the architecture makes no statement regarding imprecise exceptions related to stswx when 
XER[TBC] = 0. IBM PowerPC processors generate an imprecise exception (machine check) on this 
instruction when all of the following conditions are true: 


The instruction passes all protection bounds checking 

The address is cachable 

The address is passed to the data cache 

The address misses in the data cache (resulting in a line fill request) 

The address encounters some form of bus error (non-configured, for example) 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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stw 
Store Word 


stw RS, D(RA) 


36 RS RA D 


EA < (RA\0) + EXTS(D) 
MS(EA, 4) <— (RS) 


An effective address (EA) is formed by adding a displacement to a base address. The displacement is 
obtained by sign-extending the 16-bit D field to 32 bits. The base address is 0 when the RA field is 0, 
and is the contents of register RA otherwise. 


The contents of register RS are stored at the EA. 


Registers Altered 


« None 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-169 


stwbrx 
Store Word Byte-Reverse Indexed 


stwbrx RS, RA, RB 


31 RS RA RB 662 


EA < (RAIO0) + (RB) 
MS(EA, 4) <— (RS)oq-31 Il (RS)16-23 Il (RS)g-15 Il (RS)o-7 


An EA is formed by adding an index to a base address. The index is the contents of register RB. The 
base address is 0 when the RA field is 0, and is the contents of register RA otherwise. 


The contents of register RS are byte-reversed: the least significant byte becomes the most significant 
byte, the next least significant byte becomes the next most significant byte, and so on. The result is 
stored into the word at the EA. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
¢ None 


Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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stwecx. 
Store Word Conditional Indexed 


stwex. RS, RA, RB 


31 RS RA RB 150 


EA < (RAJ|O) + (RB) 
if RESERVE = 1 then 

MS(EA, 4) < (RS) 

RESERVE < 0 

(CR[CRO]) < 70 || 1 || XERgo 
else 

(CR[CRO]) < 70 || 0 || XERgo 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 when the RA field is 0, and is the contents of register RA 
otherwise. 


If the reservation bit contains 1 when the instruction is executed, the contents of register RS are 
stored into the word at the EA and the reservation bit is cleared. If the reservation bit contains 0 when 
the instruction is executed, no store operation is performed. 


CR[CRO] is set as follows: 


* CRI[CRO],7 gt are cleared 
* CR[CRO]eq is set to the state of the reservation bit at the start of the instruction 
* CR[CRO]go is set to the contents of the XER[SO] bit 


Registers Altered 
* CRICRO]Lt, at, Ea, so 
Programming Note 


Iwarx and the stwex. instruction should paired in a loop, as shown in the following example, to create 
the effect of an atomic operation to a memory area used as a semaphore between asynchronous 
processes. Only lwarx can set the reservation bit to 1. stwex. sets the reservation bit to 0 upon its 
completion, whether or not stwex. sent (RS) to memory. CR[CRO]Eq must be examined to determine 
whether (RS) was sent to memory. 


loop: lwarx # read the semaphore from memory; set reservation 
“alter” # change the semaphore bits in register as required 
stWCx. # attempt to store semaphore; reset reservation 

bne loop # an asynchronous process has intervened; try again 


If the asynchronous process in the code example had paired Iwarx with a store other than stwex., the 
reservation bit would not have been cleared in the asynchronous process, and the code example 
would have overwritten the semaphore. 


Exceptions 


An alignment exception occurs if the EA is not word-aligned. 


Instruction Set 9-171 


stwcx. 
Store Word Conditional Indexed 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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stwu 
Store Word with Update 


stwu RS, D(RA) 


37 RS RA D 


EA < (RA) + EXTS(D) 
MS(EA, 4) <— (RS) 
(RA) — EA 


An effective address (EA) is formed by adding a displacement to the base address in register RA. The 
displacement is obtained by sign-extending the 16-bit D field to 32 bits. The EA is placed into register 
RA. 


The contents of register RS are stored into the word at the EA. 


Registers Altered 
* RA 


Invalid Instruction Forms 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-173 


stwux 
Store Word with Update Indexed 


stwux RS, RA, RB 


31 RS RA RB 183 


EA < (RA) + (RB) 
MS(EA, 4) <— (RS) 
(RA) — EA 


An effective address (EA) is formed by adding an index to the base address in register RA. The index 
is the contents of register RB. The EA is placed into register RA. 


The contents of register RS are stored into the word at the EA. 

If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

« RA 


Invalid Instruction Forms 


« Reserved fields 
* RA=0 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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stwx 
Store Word Indexed 


stwx RS, RA, RB 


31 RS RA RB 151 


EA < (RA|O) + (RB) 
MS(EA,4) <— (RS) 


An effective address (EA) is formed by adding an index to a base address. The index is the contents 
of register RB. The base address is 0 when the RA field is 0, and is the contents of register RA 
otherwise. 


The contents of register RS are stored into the word at the EA. 

If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

* None 

Invalid Instruction Forms 

¢ Reserved fields 

Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-175 


subf 


Subtract From 


subf RT, RA, RB OE=0, Rc=0 
subf. RT, RA, RB OE=0, Rc=1 
subfo RT, RA, RB OE=1, Rc=0 
subfo. RT, RA, RB OE=1,,AGs1 
31 RT RA RB OE 40 Re 
0 6 ih 16 21 22 31 


(RT) < —(RA) + (RB) + 1 


The sum of the ones complement of register RA, register RB, and 1 is stored into register RT. 


Registers Altered 


¢ RT 


° CR[CRO], 7. GT, EQ, SO if Rc contains 1 
* XER[SO, OV] if OE contains 1 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-30. Extended Mnemonics for subf, subf., subfo, subfo. 


Mnemonic | Operands 
sub RT, RA, RB 
sub. 

subo 

subo. 


Other Registers 


Function Altered 
Subtract (RB) from (RA). 
(RT) < —(RB) + (RA) + 1. 
Extended mnemonic for 
subf RT,RB,RA 
Extended mnemonic for CR[CRO] 
subf. RT,RB,RA 
Extended mnemonic for XER[SO, OV] 
subfo RT,RB,RA 
Extended mnemonic for CR[CRO] 
subfo. RT,RB,RA XER[SO, OV] 
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subfc 
Subtract From Carrying 


subfc RT, RA, RB OE=0, Rc=0 
subfc. RT, RA, RB OE=0, Rc=1 
subfco RT, RA, RB OE=1, Rc=0 
subfco. RT, RA, RB OE=1, Rc=1 
31 RT RA RB OE 8 Re 
0) 6 11 16 21 22 31 


(RT) < —(RA) + (RB) +1 

if a(RA) + (RB) +1 $ 292-1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the ones complement of register RA, register RB, and 1 is stored into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the subtract 
operation. 


Registers Altered 

¢ RT 

* XER[CA] 

: CR[CRO]_7, GT, EQ, SO if Rc contains 1 

¢ XER[SO, OV] if OE contains 1 

Architecture Note 

This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-31. Extended Mnemonics for subfc, subfc., subfco, subfco. 


Other Registers 
Mnemonic | Operands Function Altered 


subc RT, RA, RB Subtract (RB) from (RA). 

(RT) < —(RB) + (RA) + 1. 

Place carry-out in XER[CA]. 
Extended mnemonic for 
subfc RT,RB,RA 


subc. Extended mnemonic for CR[CRO] 
subfc. RT,RB,RA 

subco Extended mnemonic for XER[SO, OV] 
subfco RT,RB,RA 

subco. Extended mnemonic for CR[CRO] 
subfco. RT,RB,RA XER[SO, OV] 


Instruction Set 9-177 


subfe 
Subtract From Extended 


subfe RT, RA, RB OE=0, Rc=0 
subfe. RT, RA, RB OE=0, Rc=1 
subfeo RT, RA, RB OE=1, Rc=0 
subfeo. RT, RA, RB OE=1, Rc=1 
31 RT RA RB OE 136 Re 
0) 6 11 16 21 22 31 


(RT) < —(RA) + (RB) + XER[CA] 

if =(RA) + (RB) + XER[CA] 5 294 — 1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the ones complement of register RA, register RB, and XER[CA] is placed into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the subtract 
operation. 


Registers Altered 

¢ RT 

* XER[CA] 

* CRICRO].t Gt, EQ, so if Re contains 1 
* XER[SO, OV] if OE contains 1 
Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


9-178 PPC405 Core User’s Manual 


subfic 


Subtract From Immediate Carrying 


subfic RT, RA, IM 


(RT) <— —(RA) + EXTS(IM) + 1 

if =(RA) + EXTS(IM) + 1 $ 282-1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the ones complement of RA, the IM field sign-extended to 32 bits, and 1 is placed into 
register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the subtract 
operation. 


Registers Altered 
¢ RT 
* XER[CA] 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-179 


subfme 


Subtract from Minus One Extended 


subfme RT, RA OE=0, Rc=0 
subfme. RT, RA OE=0, Rc=1 
subfmeo RT, RA OE=1, Rc=0 
subfmeo. RT, RA OE=1, Rc=1 
31 RT RA OE 232 Re 
0 6 11 16 21 22 31 


(RT) < —(RA)— 1 + XER[CA] 

if a(RA) + OxFFFF FFFF + XER[CA] $ 2°? —1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the ones complement of register RA, —1, and XER[CA] is placed into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the subtract 
operation. 


Registers Altered 

¢ RT 

* CRI[CRO].t Gt, ca, so if Re contains 1 
* XER[SO, OV] if OE contains 1 

* XER[CA] 

Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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subfze 


Subtract from Zero Extended 


subfze RT, RA OE=0, Rc=0 
subfze. RT, RA OE=0, Rc=1 
subfzeo RT, RA OE=1, Rc=0 
subfzeo. RT, RA OE=1, Rc=1 
31 RT RA OE 200 Re 
0 6 11 16 21 22 31 


(RT) < —(RA) + XER[CA] 

if -(RA) + XER[CA] $ 2°? —1 then 
XER[CA] < 1 

else 
XER[CA] < 0 


The sum of the ones complement of register RA and XER[CA] is stored into register RT. 


XER[CA] is set to a value determined by the unsigned magnitude of the result of the subtract 
operation. 


Registers Altered 

¢ RT 

* XER[CA] 

* CRI[CRO].t Gt, ca, so if Re contains 1 
* XER[SO, OV] if OE contains 1 
Invalid Instruction Forms 


« Reserved fields 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-181 


sync 


Synchronize 


sync 


31 598 


The sync instruction guarantees that all instructions initiated by the processor preceding sync will 
complete before sync completes, and that no subsequent instructions will be initiated by the 
processor until after sync completes. When sync completes, all storage accesses that were initiated 
by the processor before the sync instruction will have been completed with respect to all mechanisms 
that access storage. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ None. 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 


Architecturally, the eieio instruction orders storage access, not instruction completion. Therefore, 
non-storage operations that follow eieio could complete before storage operations that precede eieio. 
The sync instruction guarantees ordering of instruction completion and storage access. For the 
PPC405 core, the eieio instruction is implemented to behave as a sync instruction. 


To write code that is portable between various PowerPC implementations, programmers should use 
the mnemonic that corresponds to the desired behavior. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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tlbia 


TLB Invalidate All 


tlbia 


31 370 


All of the entries in the TLB are invalidated and become unavailable for translation by clearing the 
valid (V) bit in the TLBHI portion of each TLB entry. The rest of the fields in the TLB entries are 
unmodified. 


Registers Altered 

¢ None. 

Invalid Instruction Forms 
¢ None. 

Programming Note 


This instruction is privileged. Translation is not required to be active during the execution of this 
instruction. The effects of the invalidation are not guaranteed to be visible to the programming model 
until the completion of a context synchronizing operation. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Operating Environment. 


Instruction Set 9-183 


tlbre 


TLB Read Entry 


tlbre RT, RA, WS 
31 RT RA ws 946 
0 6 11 16 21 31 
if WS, = 1 
(RT) <— TLBLO[(RA26-31)] 
else 


(RT) <— TLBHI[(RA2¢-31)] 
(PID) < TID from TLB[(RAd¢-33)] 


The contents of the selected TLB entry is placed into register RT (and possibly into PID). 


Bits 26:31 of the contents of RA is used as an index into the TLB. If this index specifies a TLB entry 
that does not exist, the results are undefined. 


The WS field specifies which portion (TLBHI or TLBLO) of the entry is loaded into RT. If TLBHI is 
being accessed, the PID SPR is set to the value of the TID field in the TLB entry. 


If the WS field is not 0 or 1, the instruction form is invalid and the result is undefined. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 
« RT 
* PID (if ws =0) 


Invalid Instruction Forms 


« Reserved fields 
¢ Invalid WS value 


Programming Notes 


This instruction is privileged. Translation is not required to be active during the execution of this 
instruction. 


The contents of RT after the execution of this instruction are interpreted as follows: 


If WS = 0 (TLBHI): 
RT[0:21] — EPN[0:21] 
RT[22:24] — SIZE[0:2] 
RT[25] << V 
RT[26] —E 
RT[27] < UO 
RT[28:31] — 0 
PID[24:31] <— TID[0:7]; (note that the TID is copied to the PID, not to RT) 
If WS = 1 (TLBLO): 
RT[0:21] — RPN[0:21] 
RT[22:23] < EX,WR 
RT[24:27] — ZSEL[0:3] 
RT[28:31] — WIMG 
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Architecture Note 


This instruction part of the IBM PowerPC Embedded Operating Environment. 


Table 9-32. Extended Mnemonics for tlbre 


tlbre 


TLB Read Entry 


Mnemonic 


tlbrehi 


Operands 


RT, RA 


Function 


Load TLBHI portion of the selected TLB entry into RT. 
Load the PID register with the contents of the TID 
field of the selected TLB entry. 
(RT) < TLBHI[(RA)] 
(PID) <— TLB[(RA)Itip 

Extended mnemonic for 

tlbre RT,RA,O 


Other Registers 
Altered 


tlbrelo 


RT, RA 


Load TLBLO portion of the selected TLB entry into 
RT. 
(RT) < TLBLO[(RA)] 

Extended mnemonic for 

tlbre RT,RA,1 


Instruction Set 9-185 


tlbsx 


TLB Search Indexed 


tlbsx RT, RA, RB Rc=0 
tlbsx. RT, RA, RB Re=1 
31 RT RA RB 914 Re 
0 6 11 16 21 31 


EA < (RA\|O) + (RB) 
if Re = 1 
CR[CRO],7 < 0 
CR[CRO]e7 < 0 
CR[CRO]so < XER[SO] 
if Valid TLB entry matching EA and PID is in the TLB then 
(RT) < Index of matching TLB Entry 
if Re = 1 
CRICRO]Eq <1 
else 
(RT) Undefined 
if Re = 1 
CRICRO]Eq < 0 


An effective address is formed by adding an index to a base address. The index is the contents of 
register RB. The base address is 0 if the RA field is 0 and is the contents of register RA otherwise. 


The TLB is searched for a valid entry which translates EA and PID. See XREF for details. The record 
bit (Rc) specifies whether the results of the search will affect CR[CRO] as shown above. The intention 
is that CR[CRO]eq can be tested after a tlbsx. instruction if there is a possibility that the search may 
fail. 


Registers Altered 

* CRICRO].t Gt, ca, so if Re contains 1 
Invalid Instruction Forms 

¢ None. 

Programming Note 


This instruction is privileged. Translation is not required to be active during the execution of this 
instruction. 


Architecture Note 


This instruction part of the IBM PowerPC Embedded Operating Environment. 
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tlbsync 


TLB Synchronize 


tlbsync 


31 566 


The tlbsync instruction is provided in the PowerPC architecture to support synchronization of TLB 
operations among the processors of a multi-processor system. In the PPC405 core, this instruction 
performs no operation, and is provided to facilitate code portability. 


Registers Altered 

« None. 

Invalid Instruction Forms 
« None. 

Programming Notes 


This instruction is privileged. Translation is not required to be active during the execution of this 
instruction. 


Since the PPC405 core does not support tightly-coupled multiprocessor systems, tlbsync performs 
no operation. 


Architecture Note 


This instruction is part of the IBM PowerPC Embedded Operating Environment. 


Instruction Set 9-187 


tlbwe 
TLB Write Entry 


tlbwe RS, RA, WS 
31 RS RA ws 978 
0 6 11 16 21 31 
if WS, = 1 
TLBLO[(RAz¢:31)] < (RS) 
else 


TLBHI[(RA2¢-31)] < (RS) 
TID of TLB[(RA2¢6-31)] <— (P!D24:31) 


The contents of the selected TLB entry is replaced with the contents of register RS (and possibly 
PID). 


Bits 26:31 of the contents of RA are used as an index into the TLB. If this index specifies a TLB entry 
that does not exist, the results are undefined. 


The WS field specifies which portion (TLBHI or TLBLO) of the entry is replaced from RS. For 
instructions that specify TLBHI, the TID field in the TLB entry is supplied from PIDoq4.31. 


If the WS field is not 0 or 1, the instruction form is invalid and the result is undefined. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


« None. 


Invalid Instruction Forms 
« Reserved fields 


* Invalid WS value 


Programming Notes 


This instruction is privileged. Translation is not required to be active during the execution of this 
instruction. 


The effects of this update are not guaranteed to be visible to the programming model until the 
completion of a context synchronizing operation. For example, updating a zone selection field within 
the TLB while in supervisor code should be followed by an isync instruction (or other context 
synchronizing operation) to guarantee that the desired translation and protection domains are used. 


tlbwe writes the TLB fields from RS and the PID as follows: 


If WS = 0 (TLBHI): 
EPN[0:21] <— RS[0:21] 
SIZE[0:2] — RS[22:24] 
V<—RS§[25] 
E « RS[26] 
U0 « RS[27] 
TID[0:7] — PID[24:31]; (note that the TID is written from the PID, not RS) 
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tlbwe 
TLB Write Entry 
If WS = 1 (TLBLO): 
RPN(0:21] < RT[0:21] 
EX,WR < RS[22:23] 
ZSEL[0:3] < RS[24:27] 
WIMG < RS[28:31] 
Architecture Note 


This instruction part of the IBM PowerPC Embedded Operating Environment. 


Table 9-33. Extended Mnemonics for tlbwe 


Other 
Registers 
Mnemonic | Operands Function Altered 
tlbwehi RS, RA Write TLBHI portion of the selected TLB entry from 
RS. 


Write the TID register of the selected TLB entry from 
the PID register. 
TLBHI[(RA)] <— (RS) 
TLBI(RA)Itip <— (PID24:31) 
Extended mnemonic for 


tlbwe RS,RA,O 


tlbwelo RS, RA Write TLBLO portion of the selected TLB entry from 
RS. 
TLBLO[(RA)] < (RS) 

Extended mnemonic for 

tlbwe RS,RA,1 


Instruction Set 9-189 


tw 


Trap Word 
tw TO, RA, RB 
31 TO RA RB 4 
0 6 11 16 a1 31 
if ( ((RA) < (RB) ATO9 = 1) v 
((RA) > (RB) ATO; = 1) v 
((RA) = (RB) A TOs = 1) v 
((RA) < (RB) ATO3 = 1) v 
((RA) $ (RB) A TO4g = 1) ) then TRAP (see details below) 


Register RA is compared with register RB. If any comparison condition selected by the TO field is 
true, a TRAP occurs. The behavior of a TRAP depends upon the debug mode of the processor, as 
described below: 


If TRAP is not enabled as a debug event (DBCR[TDE] = 0 or DBCR[EDM,IDM] = 0,0): 
TRAP causes a program interrupt. See “Program Interrupt” on page 5-20. 


(SRRO) < address of tw instruction 
(SRR1) <— (MSR) 

(ESR[PTR]) < 1 

(MSR[WE, EE, PR, DR, IR]) < 0 
PC — EVPRo.45 || 0x0700 


If TRAP is enabled as an external debug event (DBCR[TDE] = 1 and DBCR[EDM] = 1): 
TRAP goes to the debug stop state, to be handled by an external debugger with hardware control. 
(DBSR[TIE]) < 1 


In addition, if TRAP is also enabled as an internal debug event (DBCR[IDM] = 1) 
and debug exceptions are disabled (MSR[DE] = 0), then report an imprecise event: 


(DBSR[IDE]) < 1 
PC < address of tw instruction 


If TRAP is enabled as an internal debug event and nof an external debug event (DBCR[TDE] = 1 
and DBCR[EDM,|IDM] = 0,1) and debug exceptions are enabled (MSR[DE] = 1): 


TRAP causes a debug interrupt. See “Debug Interrupt” on page 5-26. 


(SRR2) < address of tw instruction 
(SRR3) <— (MSR) 

(DBSR[TIE]) < 1 

(MSR[WE, EE, PR, CE, DE, DR, IR]) < 0 
PC <— EVPRo-15 || 0x2000 


If TRAP is enabled as an internal debug event and not an external debug event (DBCR[TDE] = 1 
and DBCR[EDM,|IDM] = 0,1) and Debug Exceptions are disabled (MSR[DE] = 0): 


TRAP reports the debug event as an imprecise event and causes a program interrupt. See 
“Program Interrupt” on page 5-20. 
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tw 
Trap Word 


(SRRO) < address of tw instruction 
(SRR1) <— (MSR) 

(ESR[PTR]) < 1 

(DBSR[TIE,IDE]) < 1,1 

(MSR[WE, EE, PR, DR, IR]) < 0 
PC <— EVPR 15 || 0x0700 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 

¢ None 

Invalid Instruction Forms 

¢ Reserved fields 

Programming Note 


This instruction is inserted into the execution stream by a debugger to implement breakpoints, and is 
not typically used by application code. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-34. Extended Mnemonics for tw 


Other Registers 
Mnemonic | Operands Function Altered 


trap Trap unconditionally. 
Extended mnemonic for 
tw 31,0,0 


tweq RA, RB Trap if (RA) equal to (RB). 
Extended mnemonic for 
tw 4,RA,RB 


twge RA, RB Trap if (RA) greater than or equal to (RB). 
Extended mnemonic for 
tw 12,RA,RB 


twgt RA, RB Trap if (RA) greater than (RB). 
Extended mnemonic for 
tw 8,RA,RB 


twle RA, RB Trap if (RA) less than or equal to (RB). 
Extended mnemonic for 
tw 20,RA,RB 


twlge RA, RB Trap if (RA) logically greater than or equal to (RB). 
Extended mnemonic for 
tw 5,RA,RB 


twigt RA, RB Trap if (RA) logically greater than (RB). 
Extended mnemonic for 
tw 1,RA,RB 


Instruction Set 9-191 


tw 
Trap Word 


Table 9-34. Extended Mnemonics for tw (continued) 


Mnemonic 


twlle 


Operands 


RA, RB 


Function 


Trap if (RA) logically less than or equal to (RB). 
Extended mnemonic for 
tw 6,RA,RB 


Other Registers 
Altered 


twillt 


RA, RB 


Trap if (RA) logically less than (RB). 
Extended mnemonic for 
tw 2,RA,RB 


twing 


RA, RB 


Trap if (RA) logically not greater than (RB). 
Extended mnemonic for 
tw 6,RA,RB 


twinl 


RA, RB 


Trap if (RA) logically not less than (RB). 
Extended mnemonic for 
tw 5,RA,RB 


twit 


RA, RB 


Trap if (RA) less than (RB). 
Extended mnemonic for 
tw 16,RA,RB 


twne 


RA, RB 


Trap if (RA) not equal to (RB). 
Extended mnemonic for 
tw 24,RA,RB 


twng 


RA, RB 


Trap if (RA) not greater than (RB). 
Extended mnemonic for 
tw 20,RA,RB 


twnl 


RA, RB 


Trap if (RA) not less than (RB). 
Extended mnemonic for 
tw 12,RA,RB 
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twi 
Trap Word Immediate 


twi TO, RA, IM 
3 TO RA IM 
0 6 11 16 31 
if( ((RA) < EXTS(IM) A TOg = 1) v 
((RA) > EXTS(IM) A TO; = 1) v 
((RA) = EXTS(IM) A TOs = 1) v 
((RA) < EXTS(IM) A TO3 = 1) v 
((RA) > EXTS(IM) A TO4 = 1) ) then TRAP (see details below) 


Register RA is compared with the IM field, which has been sign-extended to 32 bits. If any 
comparison condition selected by the TO field is true, a TRAP occurs. The behavior of a TRAP 
depends upon the Debug Mode of the processor, as described below: 


« If TRAP is not enabled as a debug event (DBCR[TDE] = 0 or DBCR[EDM,IDM] = 0,0): 
TRAP causes a program interrupt. See “Program Interrupt” on page 5-20. 


(SRRO) < address of twi instruction 
(SRR1) <— (MSR) 
(ESR[PTR]) < 1 

(MSR[WE, EE, PR, DR, IR]) < 0 

PC <— EVPRo,.15 || 0x0700 


¢ If TRAP is enabled as an External debug event (DBCR[TDE] = 1 and DBCR[EDM] = 1): 


TRAP goes to the Debug Stop state, to be handled by an external debugger with hardware control 
of the PPC405 core. 


(DBSR[TIE]) < 1 
In addition, if TRAP is also enabled as an Internal debug event (DBCR[IDM] = 1) 
and Debug Exceptions are disabled (MSR[DE] = 0), then report an imprecise event: 
(DBSR[IDE]) < 1 

PC < address of twi instruction 


« If TRAP is enabled as an Internal debug event and not an External debug event (DBCR[TDE] = 1 
and DBCR[EDM,|IDM] = 0,1) and Debug Exceptions are enabled (MSR[DE] = 1): 


TRAP causes a Debug interrupt. See “Debug Interrupt” on page 5-26. 


(SRR2) < address of twi instruction 
(SRR3) <— (MSR) 

(DBSRI[TIE]) < 1 

(MSR[WE, EE, PR, CE, DE, DR, IR]) < 0 
PC <— EVPRo-15 || 0x2000 


¢ If TRAP is enabled as an Internal debug event and not an External debug event (DBCR[TDE] = 1 
and DBCR[EDM,|IDM] = 0,1) and Debug Exceptions are disabled (MSR[DE] = 0): 


TRAP will report the debug event as an imprecise event and will cause a Program interrupt. See 
“Program Interrupt” on page 5-20. 


Instruction Set 9-193 


twi 
Trap Word Immediate 


(SRRO) < address of twi instruction 
(SRR1) <— (MSR) 

(ESR[PTR]) < 1 

(DBSR[TIE,IDE]) < 1,1 

(MSR[WE, EE, PR, DR, IR]) < 0 

PC <— EVPRo,.15 || 0x0700 


Registers Altered 
* None 
Programming Note 


This instruction is inserted into the execution stream by a debugger to implement breakpoints, and is 
not typically used by application code. 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Table 9-35. Extended Mnemonics for twi 


Other Registers 
Mnemonic | Operands Function Altered 


tweqi RA, IM Trap if (RA) equal to EXTS(IM). 
Extended mnemonic for 
twi 4,RA,IM 


twgei RA, IM Trap if (RA) greater than or equal to EXTS(IM). 
Extended mnemonic for 
twi 12,RA,IM 


twgti RA, IM Trap if (RA) greater than EXTS(IM). 
Extended mnemonic for 
twi 8,RA,IM 


twlei RA, IM Trap if (RA) less than or equal to EXTS(IM). 
Extended mnemonic for 
twi 20,RA,IM 


twigei RA, IM Trap if (RA) logically greater than or equal to 
EXTS(IM). 

Extended mnemonic for 

twi 5,RA,IM 


twigti RA, IM Trap if (RA) logically greater than EXTS(IM). 
Extended mnemonic for 
twi 1,RA,IM 


twllei RA, IM Trap if (RA) logically less than or equal to EXTS(IM). 
Extended mnemonic for 
twi 6,RA,IM 


twllti RA, IM Trap if (RA) logically less than EXTS(IM). 
Extended mnemonic for 
twi 2,RA,IM 


twingi RA, IM Trap if (RA) logically not greater than EXTS(IM). 
Extended mnemonic for 
twi 6,RA,IM 
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Table 9-35. Extended Mnemonics for twi (continued) 


twi 
Trap Word Immediate 


Other Registers 


Mnemonic | Operands Function Altered 
twinli RA, IM Trap if (RA) logically not less than EXTS(IM). 
Extended mnemonic for 
twi 5,RA,IM 
twlti RA, IM Trap if (RA) less than EXTS(IM). 
Extended mnemonic for 
twi 16,RA,IM 
twnei RA, IM Trap if (RA) not equal to EXTS(IM). 
Extended mnemonic for 
twi 24,RA,IM 
twngi RA, IM Trap if (RA) not greater than EXTS(IM). 
Extended mnemonic for 
twi 20,RA,IM 
twnli RA, IM Trap if (RA) not less than EXTS(IM). 


Extended mnemonic for 
twi 12,RA,IM 


Instruction Set 9-195 


wrtee 


Write External Enable 


wrtee RS 


31 RS 131 


MSR[EE] < (RS) +6 
The MSR[EE] is set to the value specified by bit 16 of register RS. 
If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 
Registers Altered 
* MSR[EE] 
Invalid Instruction Forms: 
¢ Reserved fields 
Programming Note 
Execution of this instruction is privileged. 
This instruction is used to provide atomic update of MSR[EE]. Typical usage is: 
mfmsr Rn #save EE in Rn{16] 


wrteei 0 #Turn off EE 
° #Code with EE disabled 


31 


wrtee Rn — #restore EE without affecting any MSR changes that occurred in the disabled code 


Architecture Note 


This instruction part of the IBM PowerPC Embedded Operating Environment. 
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wrteei 


wrteei 


Write External Enable Immediate 


31 


MSR[EE] < E 


6 16 17 21 31 


MSRJEE] is set to the value specified by the E field. 


If instruction bit 31 contains 1, the contents of CR[CRO] are undefined. 


Registers Altered 


* MSRIEE] 


Invalid Instruction Forms: 


« Reserved fields 


Programming Note 


Execution of this instruction is privileged. 


This instruction is used to provide an atomic update of MSR[EE]. Typical usage is: 


mfmsr Rn 
wrteei 0 


wrtee Rn 


#save EE in Rn[16] 
#Turn off EE 
#Code with EE disabled 


#restore EE without affecting any MSR changes that occurred in the disabled code 


Architecture Note 


This instruction part of the IBM PowerPC Embedded Operating Environment. 


Instruction Set 9-197 


xor 


XOR 
xor RA, RS, RB Rc=0 
xor. RA, RS, RB Re=1 
31 RS RA RB 316 
0 6 11 16 21 


(RA) <— (RS) ® (RB) 


The contents of register RS are XORed with the contents of register RB; the result is placed into 
register RA. 


Registers Altered 


° CR[CRO]_r, GT, EQ, SO if Rc contains 1 
° RA 


Architecture Note 


This instruction part of the IBM PowerPC Embedded Operating Environment. 
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xori 
XOR Immediate 


xori RA, RS, IM 


26 RS RA IM 


(RA) <— (RS) @ (180 |] IM) 


The IM field is extended to 32 bits by concatenating 16 0-bits on the left. The contents of register RS 
are XORed with the extended IM field; the result is placed into register RA. 


Registers Altered 
* RA 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 


Instruction Set 9-199 


xoris 
XOR Immediate Shifted 


xoris RA, RS, IM 


27 RS RA IM 


(RA) <— (RS) @ (IM |] 160) 


The IM field is extended to 32 bits by concatenating 16 0-bits on the right. The contents of register RS 
are XORed with the extended IM field; the result is placed into register RA. 


Registers Altered 
* RA 


Architecture Note 


This instruction is part of the PowerPC User Instruction Set Architecture. 
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Chapter 10. Register Summary 


All registers contained in the PPC405 core are architected as 32-bits. Table 10-1 and Table 10-2 
define the addressing required to access the registers. The pages following these tables define the bit 
usage within each register. 


The registers are grouped into categories, based on access mode: General Purpose Registers 
(GPRs), Special Purpose Registers (SPRs), Time Base Registers (TBRs), the Machine State 
Register (MSR), the Condition Register (CR), and, in standard products, Device Control Registers 
(DCRs). 


10.1 Reserved Registers 


Any register numbers not listed in the tables which follow are reserved, and should be neither read 
nor written. These reserved register numbers may be used for additional functions in future 
processors. 


10.2 Reserved Fields 


For all registers having fields marked as reserved, the reserved fields should be written as zero and 
read as undefined. That is, when writing to a reseved field, write a 0 to the field. When reading from a 
reserved field, ignore the field. 


It is good coding practice to perform the initial write to a register with reserved fields as described in 
the preceding paragraph, and to perform all subsequent writes to the register using a read-modify- 
write strategy: read the register, alter desired fields with logical instructions, and then write the 
register. 


10.3 General Purpose Registers 


The PPC405 core provides 32 General Purpose Registers (GPRs). The contents of these registers 
can be loaded from memory using load instructions and stored to memory using store instructions. 
GPRs are also addressed by all integer instructions. 


Table 10-1. PPC405 General Purpose Registers 


GPR Number 
Mnemonic Register Name Decimal Hex Access 
RO-R31 General Purpose Register 0-31 0-31 0x0-0x1F | Read/Write 


10.4 Machine State Register and Condition Register 


Because these registers are accessed using special instructions, they do not require addressing. 
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10.5 Special Purpose Registers 


Special Purpose Registers (SPRs), which are part of the PowerPC Embedded Environment, are 
accessed using the mtspr and mfspr instructions. SPRs control the use of the debug facilities, 
timers, interrupts, storage control attributes, and other architected processor resources. 


Table 10-2 shows the mnemonics, names, and numbers of the SPRs. The columns under “SPRN’ list 
the register numbers used as operands in assembler language coding of the mfspr and mtspr 
instructions. The column labeled “SPRF’” lists the corresponding fields contained in the machine code 
of mfspr and mtspr. The SPRN field contains the five-bit subfields of the SPREF field, which are 
reversed in the machine code for the mfspr and mtspr instructions (SPRN <— SPRFs5,9 || SPRFo-) 
for compatibility with the POWER Architecture. Note that the assembler handles the special coding 
transparently. 


All SPRs are privileged, except the Count Register (CTR), the Link Register (LR), SPR General 
Purpose Registers (SPRG4—SPRG7, read-only), User SPR General Purpose Register (USPRGO), 
and the Fixed-point Exception Register (XER). Note that access to the Time Base Lower (TBL) and 
Time Base Upper (TBU) registers, when addressed as SPRs, is write-only and privileged. However, 
when addressed as Time Base Registers (TBRs), read access to these registers is not privileged. 
See “Time Base Registers” on page 4. for more information. 


Table 10-2 lists the SPRs, their mnemonics and names, their numbers (SPRN) and the corresponding 
SPRF numbers, and access. All SPR numbers not listed are reserved, and should be neither read nor 
written. 


Table 10-2. Special Purpose Registers 


SPRN 
Mnemonic Register Name Decimal | Hex SPRF Access 
|CCRO —*|| Core Configuration RegisterO.=————«([ 947 ~—s | Ox3B3_| 0x27D | Read/Write | 

CTR Count Register 9 0x009 | 0x120 | Read/Write 
DAC1 Data Address Compare 1 1014 Ox3F6 | Ox2DF | Read/Write 
DAC2 Data Address Compare 2 1015 Ox3F7 | Ox2FF | Read/Write 
DBCRO Debug Control Register 0 1010 Ox3F2 | 0x25F | Read/Write 
DBCR1 Debug Control Register 1 957 Ox3BD | 0x3BD | Read/Write 
DBSR Debug Status Register 1008 Ox3FO | 0x21F | Read/Clear 
DCCR Data Cache Cachability Register 1018 Ox3FA | 0x35F | Read/Write 
DCWR Data Cache Write-through Register 954 Ox3BA | 0x35D_ | Read/Write 
DVC1 Data Value Compare 1 950 Ox3B6 | 0x2DD | Read/Write 
DVC2 Data Value Compare 2 951 Ox3B7 | 0x2FD | Read/Write 
DEAR Data Error Address Register 981 Ox3D5 | Ox2BE | Read/Write 
ESR Exception Syndrome Register 980 Ox3D4 | 0x29E_ | Read/Write 
EVPR Exception Vector Prefix Register 982 Ox3D6 | Ox2DE | Read/Write 
IAC1 Instruction Address Compare 1 1012 Ox3F4 | Ox29F | Read/Write 
IAC2 Instruction Address Compare 2 1013 Ox3F5 | 0x2B5 | Read/Write 
IAC3 Instruction Address Compare 3 948 0x3B4 | 0x29D | Read/Write 
IAC4 Instruction Address Compare 4 949 Ox3B5 | 0x2BD | Read/Write 
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Table 10-2. Special Purpose Registers (continued) 


SPRN 
Mnemonic Register Name Decimal | Hex SPRF Access 
ICCR Instruction Cache Cachability Register | 1019 Ox3FB | 0x37F | Read/Write 
ICDBDR Instruction Cache Debug Data Register | 979 0x3D3 | 0x27E | Read-only 
LR Link Register 8 0x008 |0x100 | Read/Write 
PID Process ID 945 0Ox3B1 | 0x23D_ | Read/Write 
PIT Programmable Interval Timer 987 Ox3DB_ | 0x37E_ | Read/Write 
PVR Processor Version Register 287 Ox11F | 0x3E8 | Read-only 
SGR Storage Guarded Register 953 Ox3B9 | 0x33D_ | Read/Write 
SLER Storage Little Endian Register 955 Ox3BB_ | 0x37D_ | Read/Write 
SPRGO SPR General 0 272 Ox110 | 0x208 | Read/Write 
SPRG1 SPR General 1 273 Ox111 | 0x228 | Read/Write 
SPRG2 SPR General 2 274 Ox112 | 0x248 | Read/Write 
SPRG3 SPR General 3 275 0x113 | O0x268 | Read/Write 
SPRG4 SPR General 4 260 0x104 | 0x088 | Read-only 
SPRG4 SPR General 4 276 Ox114 | 0x288 | Read/Write 
SPRG5 SPR General 5 261 0x105 | 0x0A8 | Read-only 
SPRG5 SPR General 5 277 Ox115 | Ox2A8 | Read/Write 
SPRG6 SPR General 6 262 0x106 | 0x0C8 | Read-only 
SPRG6 SPR General 6 278 Ox116 | 0x2C8 | Read/Write 
SPRG7 SPR General 7 263 0x107 | Ox0E8 | Read-only 
SPRG7 SPR General 7 279 Ox117 | Ox2E8 | Read/Write 
SRRO Save/Restore Register 0 26 Ox01A | 0x340 | Read/Write 
SRR1 Save/Restore Register 1 27 0x01B | 0x360 | Read/Write 
SRR2 Save/Restore Register 2 990 Ox3DE | 0x3DE | Read/Write 
SRR3 Save/Restore Register 3 991 Ox3DF | Ox3FE | Read/Write 
SUOR Storage User-defined 0 Register 956 Ox3BC | 0x39D | Read/Write 
TBL Time Base Lower 284 0x11C | 0x388 | Write-only 
TBU Time Base Upper 285 0x11D | 0x3A8 | Write-only 
TCR Timer Control Register 986 Ox3DA | 0x35E_ | Read/Write 
TSR Timer Status Register 984 Ox3D8 | 0x31E | Read/Clear 
USPRGO User SPR General 0 256 Ox100 |0x008 | Read/Write 
XER Fixed Point Exception Register 1 0x001 | 0x020 | Read/Write 
ZPR Zone Protection Register 944 Ox3BO | 0x21D | Privileged 
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10.6 Time Base Registers 


The PowerPC Architecture provides a 64-bit time base. Chapter 6, “Timer Facilities,” describes the 
architected time base. In the PPC405 core, the time base is implemented as two 32-bit time base 
registers (TBRs). The low-order 32 bits of the time base are read from the TBL and the high-order 32 
bits are read from the TBL. 


User-mode access to the TBRs is read-only, and there is no explicitly privileged read access to the 
time base. 


The mftb instruction reads from TBL and TBU. (Writing the time base is accomplished by moving the 
contents of a GPR to a pair of SPRs, which are also called TBL and TBU, using the mtspr 
instruction.) 


Table 10-3 shows the mnemonics, names, and numbers of the TBRs. The columns under “TBRN”’ list 
the register numbers used as operands in assembler language coding of the mftb and mtspr 
instructions. The column labeled “TBRF” lists the corresponding fields contained in the machine code 
of mftb and mtspr. The TBRN field contains two five-bit subfields of the TBRF field; the subfields are 
reversed in the machine code for the mftb and mtspr instructions (TBRN < TBRFs.9 || TBRFo-a). 
Note that the assembler handles the special coding transparently. 


Table 10-3. Time Base Registers 


TBRN 
Mnemonic Register Name Decimal Hex TBRF | Access 
/TBL —s*[ Time Base Lower (Read-only) = [268 = |0x10C_ ‘| 0x188 | Read-only | 
TBU Time Base Upper (Read-only) 269 0x10D Ox1A8 | Read-only 


10.7 Device Control Registers 


Device Control Registers (DCRs), which are architecturally outside of the processor core, are 
accessed using the mfder and mtder instructions. DCRs are used to control, configure, and hold 
status for various functional units that are not part of the RISC processor core. Although the PPC405 
core does not contain DCRs, the mfder and mtdcr instructions are provided. 


The mfder and mtdcr instructions are privileged, for all DCR numbers. Therefore, all DCR accesses 
are privileged. All DCR numbers are reserved, and should be neither read nor written, unless they are 
part of a Core+ASIC implementation. 
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10.8 Alphabetical Listing of PPC405 Registers 

The following pages list the registers available in the PPC405 core. For each register, the following 
information is supplied: 

¢ Register mnemonic and name 

* Cross-reference to a detailed register description 


¢ Register type (SPR or TBR; the names of CR, GPRO-31, and MSR are the same as their register 
types) 
¢ Register number (address) 


¢ Adiagram illustrating the register fields (all register fields have mnemonics, unless there is only 
one field) 


« A table describing the register fields, giving field mnemonic, field bit location, field name, and the 
function associated with various field values 
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CCRO 


Core Configuration Register 0 
SPR 0x3B3 
See “Core Configuration Register 0 (CCRO)” on page 4-11. 


LWL SWOA _ IPP LBDE PFNC FWOA CWS 
0 5|6|7|8 910 11 12/13) 14/15/16 19] 20) 21} 22) 23) 24 26) 27| 28 30) 31 
LWOA DPP1 UOXE PFC NCRS CIS 


Figure 10-1. Core Configuration Register 0 (CCRO) 


0:5 Reserved 


LWL Load Word as Line 

0 The DCU performs load misses or non- 
cachable loads as words, halfwords, or 
bytes, as requested 

1 For load misses or non-cachable loads, 
the DCU moves eight words (including 
the target word) into the line fill buffer 


7 LWOA_| Load Without Allocate 

0 Load misses result in line fills 

1 Load misses do not result in a line fill, but 
in non-cachable loads 


8 SWOA | Store Without Allocate 

0 Store misses result in line fills 

1 Store misses do not result in line fills, but 
in non-cachable stores 


9 DPP1 DCU PLB Priority Bit 1 Note: DCU logic dynamically controls DCU 
0 DCU PLB priority 0 on bit 1 priority bit 0. 
1 DCU PLB priority 1 on bit 1 

10:11 | IPP ICU PLB Priority Bits 0:1 


00 Lowest ICU PLB priority 
01 Next to lowest ICU PLB priority 
10 Next to highest ICU PLB priority 
11 Highest ICU PLB priority 


12:13 Reserved 


14 UOXE Enable U0 Exception 
0 Disables the U0 exception 
1 Enables the U0 exception 


15 LDBE Load Debug Enable 

0 Load data is invisible on data-side (on- 
chip memory (OCM) 

1 Load data is visible on data-side OCM 


16:19 Reserved 
20 PFC ICU Prefetching for Cachable Regions 
0 Disables prefetching for cachable 
regions 


1 Enables prefetching for cachable regions 
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CCRO (cont.) 


Core Configuration Register 0 


21 


PFNC 


ICU Prefetching for Non-Cachable Regions 

0 Disables prefetching for non-cachable 
regions 

1 Enables prefetching for non-cachable 
regions 


22 


NCRS 


Non-cachable ICU request size 
0 Requests are for four-word lines 
1 Requests are for eight-word lines 


23 


FWOA 


Fetch Without Allocate 

0 An ICU miss results in a line fill. 

1 An ICU miss does not cause a line fill, 
but results in a non-cachable fetch. 


24:26 


Reserved 


27 


CIS 


Cache Information Select 
0 Information is cache data. 
1 Information is cache tag. 


28:30 


Reserved 


31 


CWS 


Cache Way Select 
0 Cache way is A. 
1 Cache way is B. 
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CR 


Condition Register 


See “Condition Register (CR)” on page 2-10. 


CRO ai CR4 ‘i 
0 11/12 15/16 19/20 23) 24 27| 28 31 
CR1 CR3 CR5 CR7 
Figure 10-2. Condition Register (CR) 
0:3 CRO Condition Register Field 0 
4:7 CR1 Condition Register Field 1 
8:11 CR2 Condition Register Field 2 
12:15 | CR3 Condition Register Field 3 
16:19 | CR4 Condition Register Field 4 
20:23 | CR5 Condition Register Field 5 
24:27 | CR6 Condition Register Field 6 
28:31 | CR7 Condition Register Field 7 
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SPR 0x009 


CTR 


Count Register 


See “Count Register (CTR)” on page 2-6. 


31 


Figure 10-3. Count Register (CTR) 


Count 


Used as count for branch conditional with 
decrement instructions, or as address for 
branch-to-counter instructions. 
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DAC1—DAC2 


Data Address Compare Registers 


SPR 0x3F6-0x3F7 
See “Data Address Compare Registers (DAC1—DAC2)” on page 8-9. 


31 


Figure 10-4. Data Address Compare Registers (DAC1—DAC2) 


0:31 


Data Address Compare (DAC) byte 
address 


DBCRO[D1S] determines which address 
bits are examined. 
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SPR 0x3F2 


DBCRO 


Debug Control Register 0 


See “Debug Control Registers” on page 8-4. 


EDM RST 


¥ 


BT TDE IA2 1JA12X_ IA4~ 1A34X_ IA34T 


0;1}2 


act 


9} 10) 11) 12) 13) 14) 15) 16/17/18 


30 


31 


Ep] ow 


6 
5 


IAI2 ss IA3.-—s IA34—sIA12T 


Figure 10-5. Debug Control Register 0 (DBCRO) 


FT 


EDM 


External Debug Mode 
0 Disabled 
1 Enabled 


IDM 


Internal Debug Mode 
0 Disabled 
1 Enabled 


2:3 


RST 


Reset Causes a processor reset request when 


00 No action set by software. 
01 Core reset 

10 Chip reset 

11 System reset 


Attention: Writing 01, 10, or 11 to this field causes a processor reset request. 


Instruction Completion Debug Event 
0 Disabled 
1 Enabled 


BT 


Branch Taken Debug Event 
0 Disabled 
1 Enabled 


EDE 


Exception Debug Event 
0 Disabled 
1 Enabled 


TDE 


Trap Debug Event 
0 Disabled 
1 Enabled 


1A1 


IAC 1 Debug Event 
0 Disabled 
1 Enabled 


lA2 


IAC 2 Debug Event 
0 Disabled 
1 Enabled 


10 


IA12 


Instruction Address Range Compare 1-2 Registers [AC1 and IAC2 define an 
0 Disabled address range used for IAC address 
1 Enabled comparisons. 
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DBCRO (cont.) 


Debug Control Register 0 


11 


IA12X 


Enable Instruction Address Exclusive 
Range Compare 1-2 

0 Inclusive 

1 Exclusive 


Selects the range defined by IAC1 and 
IAC2 to be inclusive or exclusive. 


IA3 


IAC 3 Debug Event 
0 Disabled 
1 Enabled 


IA4 


IAC 4 Debug Event 
0 Disabled 
1 Enabled 


IA34 


Instruction Address Range Compare 3-4 
0 Disabled 
1 Enabled 


Registers IAC3 and IAC4 define an 
address range used for IAC address 
comparisons. 


IA34X 


Instruction Address Exclusive Range 
Compare 3-4 

0 Inclusive 

1 Exclusive 


Selects range defined by IAC3 and IAC4 to 
be inclusive or exclusive. 


IA12T 


Instruction Address Range Compare 1-2 
Toggle 

0 Disabled 

1 Enable 


Toggles range 12 inclusive, exclusive 
DBCR[IA12X] on debug event. 


IA34T 


Instruction Address Range Compare 3-4 
Toggle 

0 Disabled 

1 Enable 


Toggles range 34 inclusive, exclusive 
DBCR[IA34X] on debug event. 


18:30 


Reserved 


31 


FT 


Freeze timers on debug event 
0 Timers not frozen 
1 Timers frozen 
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SPR 0x3BD 


See “Debug Control Registers” on page 8-4. 


DBCR1 


Debug Control Register 1 


DIR DiW D1S DA12 DV1M DV1BE 
0);1/2/3)4 5/6 7)8/9/10 11/12 13/14 15/16 19/20 23) 24 31 
D2R he D2S DA12X DV2M DV2BE 
Figure 10-6. Debug Control Register 1 (DBCR1) 
0 DIR DAC1 Read Debug Event 
0 Disabled 
1 Enabled 
1 D2R DAC 2 Read Debug Event 
0 Disabled 
1 Enabled 
2 D1W DAC 1 Write Debug Event 
0 Disabled 
1 Enabled 
3 D2W DAC 2 Write Debug Event 
0 Disabled 
1 Enabled 
4:5 D1S DAC 1 Size Address bits used in the compare: 
00 Compare all bits 
01 Ignore Isb (least significant bit) Byte address 
10 Ignore two Isbs Halfword address 
11 Ignore five Isbs Word address 
Cache line (8-word) address 
6:7 D2s DAC 2 Size Address bits used in the compare: 
00 Compare all bits 
01 Ignore Isb (least significant bit) Byte address 
10 Ignore two Isbs Halfword address 
11 Ignore five Isbs Word address 
Cache line (8-word) address 
8 DA12 Enable Data Address Range Compare 1:2 Registers DAC1 and DAC2 define an 
0 Disabled address range used for DAC address 
1 Enabled comparisons 
AS) DA12X | Data Address Exclusive Range Compare Selects range defined by DAC1 and DAC2 
1:2 to be inclusive or exclusive 
0 Inclusive 
1 Exclusive 
10:11 Reserved 
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DBCR1 (cont.) 


Debug Control Register 1 


12:13 | DV1IM Data Value Compare 1 Mode Type of data comparison used: 
00 Undefined 
01 AND All bytes selected by DBCR1[DV1BE] must 
compare to the appropriate bytes of DVC1. 
10 OR One of the bytes selected by 
DBCR1[DV1BE] must compare to the 
appropriate bytes of DVC1. 
11 AND-OR The upper halfword or lower halfword must 
compare to the appropriate halfword in 
DVC1. When performing halfword 
compares set DBCR1[DV1BE] = 0011, 
1100, or 1111. 
14:15 | DV2M Data Value Compare 2 Mode Type of data comparison used 
00 Undefined 
01 AND All bytes selected by DBCR1[DV2BE] must 
compare to the appropriate bytes of DVC2. 
10 OR One of the bytes selected by 
DBCR1[DV2BE] must compare to the 
appropriate bytes of DVC2. 
11 AND-OR The upper halfword or lower halfword must 
compare to the appropriate halfword in 
DVC2. When performing halfword 
compares set DBCR1[DV2BE] = 0011, 
1100, or 1111. 
16:19 | DV1BE | Data Value Compare 1 Byte Selects which data bytes to use in data 
0 Disabled value comparison 
1 Enabled 
20:23 | DV2BE | Data Value Compare 2 Byte Selects which data bytes to use in data 
0 Disabled value comparison 
1 Enabled 
24:31 Reserved 
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DBSR 


Debug Status Register 
SPR 0x3F0 Read/Clear 
See “Debug Status Register (DBSR)” on page 8-7. 
IC EDE UDE lA2 DW1 DW2 _IA3 MRR 


yy yy y 4 
2)3)4)5 8 
t,t 


TIE IA1 


10/11/12) 13) 14 21) 22 23)24 31 


9 
] 


1 DR2 IDE lA4 


e) 
D> N 


BY» = 


Figure 10-7. Debug Status Register (DBSR) 


0 IC Instruction Completion Debug Event 
0 Event did not occur 
1 Event occurred 


1 BT Branch Taken Debug Event 
0 Event did not occur 
1 Event occurred 


2 EDE Exception Debug Event 
0 Event did not occur 
1 Event occurred 


3 TIE Trap Instruction Debug Event 
0 Event did not occur 
1 Event occurred 


4 UDE Unconditional Debug Event 
0 Event did not occur 
1 Event occurred 


5 IA1 IAC1 Debug Event 
0 Event did not occur 
1 Event occurred 


6 lA2 IAC2 Debug Event 
0 Event did not occur 
1 Event occurred 


7 DR1 DAC1 Read Debug Event 
0 Event did not occur 
1 Event occurred 


8 DW1 DAC1 Write Debug Event 
0 Event did not occur 
1 Event occurred 


AS) DR2 DAC2 Read Debug Event 
0 Event did not occur 
1 Event occurred 


10 DW2 DAC2 Write Debug Event 
0 Event did not occur 
1 Event occurred 
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DBSR (cont.) 


Debug Status Register 


11 IDE Imprecise Debug Event 

0 No circumstance that would cause a 
debug event (if MSR[DE] = 1) occurred 

1 A debug event would have occurred, but 
debug exceptions were disabled 
(MSR[DE] = 0) 


12 IA3 IAC3 Debug Event 
0 Event did not occur 
1 Event occurred 


13 |A4 IAC4 Debug Event 
0 Event did not occur 
1 Event occurred 


14:21 Reserved 
22:23 | MRR_ | Most Recent Reset This field is set to a value, indicating the 
00 No reset has occurred since last type of reset, when a reset occurs. 


cleared by software. 
01 Core reset 
10 Chip reset 
11 System reset 


24:31 Reserved 
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SPR 0x3FA 


See “Real-Mode Storage Attribute Control” on page 7-17. 


DCCR 


Data Cache Cacheability Register 


SO S2 S4 S6 S8 S10 S12 $20 S22 S24 S26 $30 
0/1) 2)3|)4/5/6)7)8/9)10/11/12)1 19) 20) 21) 22/23) 24) 25) 26) 27/28] 29) 30) 31 
$1 $3 S7 Sg S11 $19 S21 S23 S25 S27 $29 $31 
Figure 10-8. Data Cache Cachability Register (DCCR) 
0 SO 0 Noncachable 0x0000 0000 —0x07FF FFFF 
1 Cachable 
1 $1 0 Noncachable 0x0800 0000 —Ox0FFF FFFF 
1 Cachable 
2 $2 0 Noncachable 0x1000 0000 —0x17FF FFFF 
1 Cachable 
3 $3 0 Noncachable 0x1800 0000 —0x1 FFF FFFF 
1 Cachable 
4 $4 0 Noncachable 0x2000 0000 —0x27FF FFFF 
1 Cachable 
5 $5 0 Noncachable 0x2800 0000 —O0x2FFF FFFF 
1 Cachable 
6 S6 0 Noncachable 0x3000 0000 —0x37FF FFFF 
1 Cachable 
7 $7 0 Noncachable 0x3800 0000 —Ox3FFF FFFF 
1 Cachable 
8 $8 0 Noncachable 0x4000 0000 —0x47FF FFFF 
1 Cachable 
9 $9 0 Noncachable 0x4800 0000 —Ox4FFF FFFF 
1 Cachable 
10 $10 0 Noncachable 0x5000 0000 —0x57FF FFFF 
1 Cachable 
11 S11 0 Noncachable 0x5800 0000 —Ox5FFF FFFF 
1 Cachable 
12 $12 0 Noncachable 0x6000 0000 —0x67FF FFFF 
1 Cachable 
13 $13 0 Noncachable 0x6800 0000 —Ox6FFF FFFF 
1 Cachable 
14 $14 0 Noncachable 0x7000 0000 —0x77FF FFFF 
1 Cachable 
15 $15 0 Noncachable 0x7800 0000 —Ox7FFF FFFF 
1 Cachable 
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DCCR (cont.) 


Data Cache Cacheability Register 


16 $16 0 Noncachable 0x8000 0000 —0x87FF FFFF 
1 Cachable 

17 S17 0 Noncachable 0x8800 0000 —Ox8FFF FFFF 
1 Cachable 

18 $18 0 Noncachable 0x9000 0000 —0x97FF FFFF 
1 Cachable 

19 $19 0 Noncachable 0x9800 0000 —Ox9FFF FFFF 
1 Cachable 

20 $20 0 Noncachable OxA000 0000—OxA7FF FFFF 
1 Cachable 

21 $21 0 Noncachable 0xA800 0000—-OxAFFF FFFF 
1 Cachable 

22 $22 0 Noncachable 0xBO00 0000—0xB7FF FFFF 
1 Cachable 

23 $23 0 Noncachable 0xB800 0000—OxBFFF FFFF 
1 Cachable 

24 $24 0 Noncachable 0xC000 0000—0xC7FF FFFF 
1 Cachable 

25 $25 0 Noncachable 0xC800 0000—0xCFFF FFFF 
1 Cachable 

26 $26 0 Noncachable 0xD000 0000—0xD7FF FFFF 
1 Cachable 

27 S27 0 Noncachable 0xD800 0000—-OxDFFF FFFF 
1 Cachable 

28 $28 0 Noncachable 0xE000 0000—OxE7FF FFFF 
1 Cachable 

29 $29 0 Noncachable 0xE800 0000—-OxEFFF FFFF 
1 Cachable 

30 $30 0 Noncachable OxFO00 0000—OxF7FF FFFF 
1 Cachable 

31 $31 0 Noncachable OxF800 0000 -OxFFFF FFFF 
1 Cachable 

10-18 PPC405 Core User’s Manual 


DCWR 


Data Cache Write-through Register 
SPR 0x3BA 
See “Real-Mode Storage Attribute Control” on page 7-17. 


wo Wwe Ww4 W6 ws Wi0 Wi2 W114 Wi6 Wi8 W20 W22 W24 W26 W28 WS30 


a SL, OE SS, OR GR SS A CO SR OS 


0/1)2)3)4/5] 6] 7) 8} 9 |10) 11] 12) 13) 14) 15) 16) 17) 18] 19) 20) 21 | 22| 23) 24) 25) 26| 27) 28) 29) 30] 31 
W1 W3 W5 W7 wWw9 Wii W1i3 W15 W17 W1i9 W221 W23 W25 W27 W29 W231 
Figure 10-9. Data Cache Write-through Register (DCWR) 
0 Wo 0 Write-back 0x0000 0000 —-0x07FF FFFF 
1 Write-through 
1 W1 0 Write-back 0x0800 0000 —OxOFFF FFFF 
1 Write-through 
2 W2 0 Write-back 0x1000 0000-—0x17FF FFFF 
1 Write-through 
3 W3 0 Write-back 0x1800 0000 —0x1FFF FFFF 
1 Write-through 
4 W4 0 Write-back 0x2000 0000 —-0x27FF FFFF 
1 Write-through 
5 W5 0 Write-back 0x2800 0000 —0x2FFF FFFF 
1 Write-through 
6 W6 0 Write-back 0x3000 0000 —0x37FF FFFF 
1 Write-through 
7 W7 0 Write-back 0x3800 0000 —Ox3FFF FFFF 
1 Write-through 
8 W8 0 Write-back 0x4000 0000 —0x47FF FFFF 
1 Write-through 
9 wg 0 Write-back 0x4800 0000 —0x4FFF FFFF 
1 Write-through 
10 W10 0 Write-back 0x5000 0000 —-0x57FF FFFF 
1 Write-through 
11 W11 0 Write-back 0x5800 0000 —Ox5FFF FFFF 
1 Write-through 
12 W12 0 Write-back 0x6000 0000 —-0x67FF FFFF 
1 Write-through 
13 W13 0 Write-back 0x6800 0000 —Ox6FFF FFFF 
1 Write-through 
14 W14_ | 0 Write-back 0x7000 0000 -—0x77FF FFFF 
1 Write-through 
15 W15 0 Write-back 0x7800 0000 —0x7FFF FFFF 
1 Write-through 
Register Summary 10-19 


DCWR (cont.) 


Data Cache Write-through Register 


16 W16 0 Write-back 0x8000 0000 —0x87FF FFFF 
1 Write-through 

17 W17 | 0 Write-back 0x8800 0000 —Ox8FFF FFFF 
1 Write-through 

18 W18 O Write-back 0x9000 0000 -—0x97FF FFFF 
1 Write-through 

19 Ww19 0 Write-back 0x9800 0000 —Ox9FFF FFFF 
1 Write-through 

20 W20 0 Write-back 0xA000 0000—OxA7FF FFFF 
1 Write-through 

21 W21 0 Write-back 0xA800 0000—OxAFFF FFFF 
1 Write-through 

22 W22 0 Write-back 0xB000 0000—-0xB7FF FFFF 
1 Write-through 

23 W23 0 Write-back 0xB800 0000-—OxBFFF FFFF 
1 Write-through 

24 W24 | 0 Write-back O0xC000 0000—OxC7FF FFFF 
1 Write-through 

25 W25 0 Write-back 0xC800 0000—OxCFFF FFFF 
1 Write-through 

26 W26 0 Write-back 0xD000 0000—-0xD7FF FFFF 
1 Write-through 

27 W27 | 0 Write-back 0xD800 0000—-OxDFFF FFFF 
1 Write-through 

28 W28 0 Write-back 0xE000 0000—-OxE7FF FFFF 
1 Write-through 

29 W29 0 Write-back 0xE800 0000—OxEFFF FFFF 
1 Write-through 

30 W30 0 Write-back OxFO000 0000 —OxF7FF FFFF 
1 Write-through 

31 W31 0 Write-back OxF800 0000 —OxFFFF FFFF 
1 Write-through 
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DEAR 


Data Exception Address Register 
SPR 0x3D5 
See “Data Exception Address Register (DEAR)” on page 5-13. 


Figure 10-10. Data Exception Address Register (DEAR) 


0:31 Address of Data Error (synchronous) 
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DVC1—DVC2 


Data Value Compare Registers 


SPR 0x3B6-0x3B7 
See “Data Value Compare Registers (DVC1—DVC2)” on page 8-10. 


31 


Figure 10-11. Data Value Compare Registers (DVC1—DVC2) 


0:31 


Data Value to Compare 
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ESR 


Exception Syndrome Register 
SPR 0x3D4 
See “Exception Syndrome Register (ESR)” on page 5-11. 


MCI PIL PTR DST PFP UOF 
+ 3| 4 6} 7) 8| 9}10 11}12/13) 14) 15) 16) 17 3 


up| on 
> 


R PEU DIZ PAP 


Figure 10-12. Exception Syndrome Register (ESR) 


0 MCI Machine check—instruction 
0 Instruction machine check did not occur. 
1 Instruction machine check occurred. 


1:3 Reserved 


4 PIL Program interrupt—illegal 
0 Illegal Instruction error did not occur. 
1 Illegal Instruction error occurred. 


5 PPR Program interrupt—privileged 
0 Privileged instruction error did not occur. 
1 Privileged instruction error occurred. 


6 PTR Program interrupt—trap 

0 Trap with successful compare did not 
occur. 

1 Trap with successful compare occurred. 


7 PEU Program interrupt—Unimplemented 

0 APU/FPU unimplemented exception did 
not occur. 

1 APU/FPU unimplemented exception 
occurred. 


8 DST Data storage interrupt—store fault 

0 Excepting instruction was not a store. 

1 Excepting instruction was a store 
(includes debi, dcbz, and dccci). 


AS) DIZ Data/instruction storage interrupt—zone 
fault 

0 Excepting condition was not a zone fault. 
1 Excepting condition was a zone fault. 


10:11 Reserved 


12 PFP Program interrupt—FPU 
O FPU interrupt did not occur. 
1 FPU interrupt occurred. 


13 PAP Program interrupt—APU 
0 APU interrupt did not occur. 
1 APU interrupt occurred. 


14:15 Reserved 
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ESR (cont.) 


Exception Syndrome Register 


16 


UOF 


Data storage interrupt—UO fault 

0 Excepting instruction did not cause a U0 
fault. 

1 Excepting instruction did cause a U0 
fault. 


17:31 


Reserved 
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SPR 0x3D6 


See “Exception Vector Prefix Register (EVPR)” on page 5-10. 


EVPR 


Exception Vector Prefix Register 


EVP 
0 15) 16 31 
Figure 10-13. Exception Vector Prefix Register (EVPR) 
0:15 EVP | Exception Vector Prefix 
16:31 Reserved 
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GPRO-GPR31 


General Purpose Registers 


See “General Purpose Registers (RO-R31)” on page 2-5. 


31 


Figure 10-14. General Purpose Registers (RO-R31) 


0:31 


General Purpose Register data 
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SPR 0x3F4—0x3F5 


IAC1-IAC4 


Instruction Address Compare Registers 


See “Instruction Address Compare Registers (IAC1—IAC4)” on page 8-9. 


0 29/30 31 
Figure 10-15. Instruction Address Compare Registers (IAC1-IAC4) 
0:29 Instruction Address Compare word Omit two low-order bits of complete 
address address. 
30:31 Reserved 


Register Summary 
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ICCR 


Instruction Cache Cacheability Register 


SPR 0x3FB 


See “Real-Mode Storage Attribute Control” on page 7-17. 


SO S2 S4 S6 S8 S10 S12 S14 S16 S18 S20 S22 S24 S26 S28 S830 
0) 1/2] 3/4) 5] 6] 7) 8) 9} 10/11} 12) 13) 14) 15) 16) 17) 18) 19) 20) 21 | 22) 23) 24] 25) 26) 27| 28] 29| 30) 31 
Si S$3 S5 S7 $9 S11 Si3 S15 S17 S19 S21 S23 S25 S27 S29 $31 

Figure 10-16. Instruction Cache Cachability Register (ICCR) 

0 SO 0 Noncachable 0x0000 0000 —0x07FF FFFF 
1 Cachable 

1 $1 0 Noncachable 0x0800 0000—OxOFFF FFFF 
1 Cachable 

2 $2 0 Noncachable 0x1000 0000 —0x17FF FFFF 
1 Cachable 

3 $3 0 Noncachable 0x1800 0000—0x1FFF FFFF 
1 Cachable 

4 $4 0 Noncachable 0x2000 0000 —0x27FF FFFF 
1 Cachable 

5 $5 0 Noncachable 0x2800 0000 —O0x2FFF FFFF 
1 Cachable 

6 S6 0 Noncachable 0x3000 0000 —0x37FF FFFF 
1 Cachable 

7 $7 0 Noncachable 0x3800 0000 —Ox3FFF FFFF 
1 Cachable 

8 $8 0 Noncachable 0x4000 0000 —0x47FF FFFF 
1 Cachable 

9 $9 0 Noncachable 0x4800 0000 —Ox4FFF FFFF 
1 Cachable 

10 $10 0 Noncachable 0x5000 0000 —0x57FF FFFF 
1 Cachable 

11 $11 0 Noncachable 0x5800 0000 —Ox5FFF FFFF 
1 Cachable 

12 $12 0 Noncachable 0x6000 0000 —0x67FF FFFF 
1 Cachable 

13 $13 0 Noncachable 0x6800 0000 —Ox6FFF FFFF 
1 Cachable 

14 $14 0 Noncachable 0x7000 0000 —0x77FF FFFF 
1 Cachable 

15 $15 0 Noncachable 0x7800 0000 —Ox7FFF FFFF 
1 Cachable 
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ICCR (cont.) 


Instruction Cache Cacheability Register 


16 $16 0 Noncachable 0x8000 0000 —0x87FF FFFF 
1 Cachable 

17 $17 0 Noncachable 0x8800 0000 —Ox8FFF FFFF 
1 Cachable 

18 $18 0 Noncachable 0x9000 0000 —0x97FF FFFF 
1 Cachable 

19 $19 0 Noncachable 0x9800 0000 —Ox9FFF FFFF 
1 Cachable 

20 $20 0 Noncachable OxA000 0000—OxA7FF FFFF 
1 Cachable 

21 $21 0 Noncachable 0xA800 0000—OxAFFF FFFF 
1 Cachable 

22 $22 0 Noncachable 0xBO00 0000—0xB7FF FFFF 
1 Cachable 

23 $23 0 Noncachable 0xB800 0000—OxBFFF FFFF 
1 Cachable 

24 $24 0 Noncachable 0xC000 0000—-0xC7FF FFFF 
1 Cachable 

25 $25 0 Noncachable 0xC800 0000—OxCFFF FFFF 
1 Cachable 

26 $26 0 Noncachable 0xD000 0000—0xD7FF FFFF 
1 Cachable 

27 $27 0 Noncachable 0xD800 0000—OxDFFF FFFF 
1 Cachable 

28 $28 0 Noncachable 0xE000 0000—OxE7FF FFFF 
1 Cachable 

29 $29 0 Noncachable 0xE800 0000—OxEFFF FFFF 
1 Cachable 

30 $30 0 Noncachable OxFO00 0000—OxF7FF FFFF 
1 Cachable 

31 $31 0 Noncachable OxF800 0000 —OxFFFF FFFF 


1 Cachable 


Register Summary 
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ICDBDR 


Instruction Cache Debug Data Register 


SPR 0x3D3 Read-Only 


See “ICU Debugging” on page 4-14. 


31 


Figure 10-17. Instruction Cache Debug Data Register (ICDBDR) 


0:31 


Instruction cache information See icread, page -68. 


ICU tag information is placed into the ICDBDR as shown: 


0:21 TAG Cache Tag 

22:26 Reserved 

27 V Cache Line Valid 
0 Not valid 
1 Valid 

28:30 Reserved 

31 LRU Least Recently Used (LRU) 
0 A-way LRU 
1 B-way LRU 
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LR 


Link Register 
SPR 0x008 
See “Link Register (LR)” on page 2-7. 


Figure 10-18. Link Register (LR) 


0:31 Link Register contents If (LR) represents an instruction address, 
LR39-31 should be 0. 
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MSR 


Machine State Register 


See “Machine State Register (MSR)” on page 5-7. 


APE CE PR ME DWE FE1 DR 


ee Sees ee eee See eee 


W 11/12)13)14)15)16)17/18)19}20)21 }22)23)24 25)26)/27|28 


31 


i cat We aon | oh t 


WE EE FP FEO DE IR 


> 
aes 


Figure 10-19. Machine State Register (MSR) 


0:5 Reserved 


6 AP Auxiliary Processor Available 
0 APU not available. 
1 APU available. 


7:11 Reserved 


12 APE APU Exception Enable 
0 APU exception disabled. 
1 APU exception enabled. 


clears WE. 


13 WE Wait State Enable If MSR[WE] = 1, the processor remains in 
0 The processor is not in the wait state. the wait state until an interrupt is taken, a 
1 The processor is in the wait state. reset occurs, or an external debug tool 


1 Critical interrupts are enabled. 


14 CE Critical Interrupt Enable Controls the critical interrupt input and 
0 Critical interrupts are disabled. watchdog timer first time-out interrupts. 


15 Reserved 


0 Asynchronous interruptsare disabled. input, PIT, and FIT interrupts. 
1 Asynchronous interrupts are enabled. 


16 EE External Interrupt Enable Controls the non-critical external interrupt 


17 PR Problem State 

0 Supervisor state (all instructions 
allowed). 

1 Problem state (some instructions not 
allowed). 


18 FP Floating Point Available 

0 The processor cannot execute floating- 
point instructions 

1 The processor can execute floating-point 
instructions 


19 ME Machine Check Enable 
0 Machine check interrupts are disabled. 
1 Machine check interrupts are enabled. 
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MSR (cont.) 


Machine State Register 


20 


FEO 


Floating-point exception mode 0 

O If MSR[FE1] = 0, ignore exceptions 
mode; if MSR[FE1] = 1, imprecise 
nonrecoverable mode 


1 If MSR[FE1] = 0, imprecise recoverable 


mode; if MSR[FE1] = 1, precise mode 


21 


DWE 


Debug Wait Enable 
0 Debug wait mode is disabled. 
1 Debug wait mode is enabled. 


22 


DE 


Debug Interrupts Enable 
0 Debug interrupts are disabled. 
1 Debug interrupts are enabled. 


23 


FE1 


Floating-point exception mode 1 

0 If MSR[FEO] = 0, ignore exceptions 
mode; if MSR[FEO] = 1, imprecise 
recoverable mode 

1 If MSR[FEO] = 0, imprecise non- 
recoverable mode; if MSR[FEO] = 1, 
precise mode 


24:25 


Reserved 


26 


Instruction Relocate 

0 Instruction address translation is 
disabled. 

1 Instruction address translation is 
enabled. 


27 


DR 


Data Relocate 
0 Data address translation is disabled. 
1 Data address translation is enabled. 


28:31 


Reserved 


Register Summary 
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PID 


Process ID 
SPR 0x3B1 
See “Address Translation” on page 7-1. 


0 23) 24 


Figure 10-20. Process ID (PID) 


0:23 Reserved 


24:31 Process ID 
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SPR 0x3DB 


See “Programmable Interval Timer (PIT)” on page 6-4. 


PIT 


Programmable Interval Timer 


31 


Figure 10-21. Programmable Interval Timer (PIT) 


Programmed interval remaining 


Number of clocks remaining until the PIT 


event 


Register Summary 
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PVR 


Processor Version Register 


SPR 0x11F Read-Only 


See “Processor Version Register (PVR)” on page 2-10. 


OWN CAS AID 
0 11/12 15/16 21/22 25) 26 31 
UDEF PCL 
Figure 10-22. Processor Version Register (PVR) 
0:11 OWN | Owner Identifier Identifies the owner of a core 
12:15 | PCF Processor Core Family Identifies the processor core family. 
16:21 | CAS Cache Array Sizes Identifies the cache array sizes. 
22:25 | PCL Processor Core Version Identifies the core version for a specific 
combination of PVR[PCF] and PVR[CAS] 
26:31 | AID ASIC Identifier Assigned sequentially; identifies an ASIC 
function, version, and technology 
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SGR 


Storage Guarded Register 
SPR 0x3B9 
See “Real-Mode Storage Attribute Control” on page 7-17. 
G2 G4 G10 G12 G14 G16 G18 G20 G22 G24 G26 SG28 G30 


GO G6 G8 
a cae, a, SR Se Se RO CO OS, OO SR 
0/1/2/3}4 | 5] 6} 7| 8| 9) 10) 11) 12) 13) 14) 15) 16/17) 18) 19) 20) 21) 22) 23) 24) 25) 26) 27/28) 29 


30) 31 


ae oh oe ee eee 


Gi G3 GS G7 G9 Gili Gi3 Gi5 Gi7 Gi9 G21 G23 G25 G27 G2 G31 


Figure 10-23. Storage Guarded Register (SGR) 


0 GO 0 Normal 0x0000 0000 —0x07FF FFFF 
1 Guarded 

1 Gl 0 Normal 0x0800 0000 —OxOFFF FFFF 
1 Guarded 

2 G2 0 Normal 0x1000 0000 —0x17FF FFFF 
1 Guarded 

3 G3 0 Normal 0x1800 0000 —0x1FFF FFFF 
1 Guarded 

4 G4 0 Normal 0x2000 0000 —0x27FF FFFF 
1 Guarded 

5 G5 0 Normal 0x2800 0000 —Ox2FFF FFFF 
1 Guarded 

6 G6 0 Normal 0x3000 0000 —0x37FF FFFF 
1 Guarded 

7 G7 0 Normal 0x3800 0000 —Ox3FFF FFFF 
1 Guarded 

8 G8 0 Normal 0x4000 0000 —0x47FF FFFF 
1 Guarded 

9 eis) 0 Normal 0x4800 0000 —0x4FFF FFFF 
1 Guarded 

10 G10 0 Normal 0x5000 0000 —0x57FF FFFF 
1 Guarded 

11 G11 0 Normal 0x5800 0000 —Ox5FFF FFFF 
1 Guarded 

12 G12 0 Normal 0x6000 0000 —0x67FF FFFF 
1 Guarded 

13 G13 0 Normal 0x6800 0000 —Ox6FFF FFFF 
1 Guarded 

14 G14 0 Normal 0x7000 0000 —0x77FF FFFF 
1 Guarded 

15 G15 0 Normal 0x7800 0000 —Ox7FFF FFFF 
1 Guarded 
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SGR (cont.) 


Storage Guarded Register 


16 G16 0 Normal 0x8000 0000 —0x87FF FFFF 
1 Guarded 

17 G17 0 Normal 0x8800 0000 —Ox8FFF FFFF 
1 Guarded 

18 G18 0 Normal 0x9000 0000 -0x97FF FFFF 
1 Guarded 

19 G19 0 Normal 0x9800 0000 —Ox9FFF FFFF 
1 Guarded 

20 G20 0 Normal 0xA000 0000—OxA7FF FFFF 
1 Guarded 

21 G21 0 Normal 0xA800 0000—OxAFFF FFFF 
1 Guarded 

22 G22 0 Normal 0xB000 0000—0xB7FF FFFF 
1 Guarded 

23 G23 0 Normal 0xB800 0000—OxBFFF FFFF 
1 Guarded 

24 G24 0 Normal 0xC000 0000—0xC7FF FFFF 
1 Guarded 

25 G25 0 Normal 0xC800 0000—-OxCFFF FFFF 
1 Guarded 

26 G26 0 Normal 0xD000 0000—0xD7FF FFFF 
1 Guarded 

27 G27 0 Normal 0xD800 0000—OxDFFF FFFF 
1 Guarded 

28 G28 0 Normal 0xE000 0000—-0xE7FF FFFF 
1 Guarded 

29 G29 0 Normal OxE800 0000—OxEFFF FFFF 
1 Guarded 

30 G30 0 Normal OxF000 0000 —OxF7FF FFFF 
1 Guarded 

31 G31 0 Normal OxF800 0000 —OxFFFF FFFF 
1 Guarded 

10-38 PPC405 Core User’s Manual 


SLER 


Storage Little-Endian Register 
SPR 0x3BB 
See “Real-Mode Storage Attribute Control” on page 7-17. 


SO s2 S4 S6 S8 S10 S12 S14 S16 S18 S20 S22 S24 S26 $28 S30 
0/1] 2/3] 4] 5] 6] 7] 8] 9] 10] 11/12) 13] 14] 15] 16/17/18] 19] 20] 21/22) 23) 24] 25] 26/27) 28] 29] 30] 31 
Si S3 S5 S7 S9 S11 S13 S15 S17 S19 S21 S23 $25 S27 $29 S31 
Figure 10-24. Storage Little-Endian Register (SLER) 
0 SO 0 Big endian 0x0000 0000 —-0x07FF FFFF 
1 Little endian 
1 S1 0 Big endian 0x0800 0000 —-0x0FFF FFFF 
1 Little endian 
2 S2 0 Big endian 0x1000 0000 -0x17FF FFFF 
1 Little endian 
3 S3 0 Big endian 0x1800 0000-0x1FFF FFFF 
1 Little endian 
= S4 0 Big endian 0x2000 0000 -0x27FF FFFF 
1 Little endian 
5 S5 0 Big endian 0x2800 0000—Ox2FFF FFFF 
1 Little endian 
6 S6 0 Big endian 0x3000 0000 -0x37FF FFFF 
1 Little endian 
7 S7 0 Big endian 0x3800 0000 —-0x3FFF FFFF 
1 Little endian 
8 $8 0 Big endian 0x4000 0000 -0x47FF FFFF 
1 Little endian 
9 S9 0 Big endian 0x4800 0000-0x4FFF FFFF 
1 Little endian 
10 S10 | 0 Big endian 0x5000 0000 —-0x57FF FFFF 
1 Little endian 
11 S11 | 0 Big endian 0x5800 0000 -0x5FFF FFFF 
1 Little endian 
12 S12 | 0 Big endian 0x6000 0000 —-0x67FF FFFF 
1 Little endian 
13 S13 | 0 Big endian 0x6800 0000 —-Ox6FFF FFFF 
1 Little endian 
14 S14 | 0 Big endian 0x7000 0000 -0x77FF FFFF 
1 Little endian 
15 S15 | 0 Big endian 0x7800 0000 -—Ox7FFF FFFF 
1 Little endian 
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SLER (cont.) 


Storage Little-Endian Register 


16 S16 | 0 Big endian 0x8000 0000 -0x87FF FFFF 
1 Little endian 

17 S17__| 0 Big endian 0x8800 0000 -Ox8FFF FFFF 
1 Little endian 

18 S18 | 0 Big endian 0x9000 0000 -0x97FF FFFF 
1 Little endian 

19 S19 | 0 Big endian 0x9800 0000 -Ox9FFF FFFF 
1 Little endian 

20 S20 | 0 Big endian 0xA000 0000-0xA7FF FFFF 
1 Little endian 

21 S21 | 0 Big endian 0xA800 0000—OxAFFF FFFF 
1 Little endian 

22 S22 | 0 Big endian 0xB000 0000-0xB7FF FFFF 
1 Little endian 

23 S23 | 0 Big endian 0xB800 0000-0xBFFF FFFF 
1 Little endian 

24 S24 | 0 Big endian 0xC000 0000 -OxC7FF FFFF 
1 Little endian 

25 S25 _| 0 Big endian 0xC800 0000—OxCFFF FFFF 
1 Little endian 

26 S26 | 0 Big endian 0xD000 0000-0xD7FF FFFF 
1 Little endian 

27 S27__| 0 Big endian 0xD800 0000—OxDFFF FFFF 
1 Little endian 

28 S28 | 0 Big endian OxE000 0000-0xE7FF FFFF 
1 Little endian 

29 S29 | 0 Big endian 0xE800 0000-0xEFFF FFFF 
1 Little endian 

30 S30 | 0 Big endian OxF000 0000 —-OxF7FF FFFF 
1 Little endian 

31 S31 | 0 Big endian OxF800 0000 —OxFFFF FFFF 
1 Little endian 
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SPRGO-SPRG7 


Special Purpose Registers General 
SPR 0x104—0x107 (User Read-only); 0x110-0x117 (Privileged Read/Write) 
See “Special Purpose Register General (SPRGO-SPRG7)” on page 2-9. 


Figure 10-25. Special Purpose Registers General (SPRGO—SPRG7) 


0:31 General data Software value; no hardware usage. 
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SRRO 


Save/Restore Register 0 
SPR 0x01A 
See “Save/Restore Registers 0 and 1 (SRRO-SRR1)” on page 5-9. 


0 29/30 31 


Figure 10-26. Save/Restore Register 0 (SRRO) 


0:29 SRRO receives an instruction address when a non-critical interrupt is taken; 
the Program Counter is restored from SRRO when rfi executes. 
30:31 Reserved 
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SRR1 


Save/Restore Register 1 
SPR 0x01B 
See “Save/Restore Registers 0 and 1 (SRRO-SRR1)” on page 5-9. 


APE CE PR ME DWE  FE1 DR 
+4 yy 4 4 t 
0 5/6/7 11/12)13)14)15)16)17/18)19}20)21 }22)23 24 25/26/27 |28 31 
t t t 
AP WE EE FP FEO DE | 


Figure 10-27. Save/Restore Register 1 (SRR1) 


0:31 SRR1 receives a copy of the MSR when an 
interrupt is taken; the MSR is restored from 
SRR1 when rfi executes. 
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SRR2 


Save/Restore Register 2 
SPR 0x3DE 
See “Save/Restore Registers 2 and 3 (SRR2-SRR3)” on page 5-9. 


0 29/30 31 


Figure 10-28. Save/Restore Register 2 (SRR2) 


0:29 SRR2 receives an instruction address when a critical interrupt is taken; the Program 
Counter is restored from SRR2 when rfci executes. 
30:31 Reserved 
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SRR3 


Save/Restore Register 3 
SPR 0x3DF 
See “Save/Restore Registers 2 and 3 (SRR2-SRR3)” on page 5-9. 


APE CE PR ME DWE FE1 DR 
+ eee eee ¢ 
0 5/6/7 11/12)13)14)15)16)17/18)19}20)21 }22)23 24 25)26/27|28 31 
t t ae? oe a t 
AP WE EE FP FEO DE IR 


Figure 10-29. Save/Restore Register 3 (SRR3) 


0:31 SRR3 receives a copy of the MSR when a 
critical interrupt is taken; the MSR is 
restored from SRR3 when rfci executes. 
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SUOR 


Storage User-Defined 0 Register 


SPR 0x3BC 


See “Real-Mode Storage Attribute Control” on page 7-17. 


UDO UD2 UD4 UD6 UD8 UDIO0 UDi2 UD14 UD1I6 UD18 UD20 UD22 UD24 UD26 UD28 UD30 


, 


yy y 4 


4 


yy 
0; 1) 2 


3 


t 
415 


yy iy ¥ 4 
6) 7) 8|9/10 


11) 12) 13) 14 


15 


16 


_* 


18 


19] 20) 21) 22| 23) 24) 25) 26| 27 


28 


29 


30 


31 


UD1 UD3 UD5 UD7 UD9 UDi1 UD13 UD15 UD17 UD19 UD21 UD23 UD25 UD27 UD29 UD31 
Figure 10-30. Storage User-defined 0 Register (SUOR) 

0 UDO 0 Storage compression is off 0x0000 0000 —0x07FF FFFF 
1 Storage compression is on 

1 UD1 0 Storage compression is off 0x0800 0000 —OxOFFF FFFF 
1 Storage compression is on 

2 UD2 0 Storage compression is off 0x1000 0000 —0x17FF FFFF 
1 Storage compression is on 

3 UD3 0 Storage compression is off 0x1800 0000 —0x1FFF FFFF 
1 Storage compression is on 

4 UD4 0 Storage compression is off 0x2000 0000 —0x27FF FFFF 
1 Storage compression is on 

5 UD5 0 Storage compression is off 0x2800 0000 —Ox2FFF FFFF 
1 Storage compression is on 

6 UD6 0 Storage compression is off 0x3000 0000 —0x37FF FFFF 
1 Storage compression is on 

7 UD7 0 Storage compression is off 0x3800 0000 —Ox3FFF FFFF 
1 Storage compression is on 

8 UD8 0 Storage compression is off 0x4000 0000 —0x47FF FFFF 
1 Storage compression is on 

AS) UD9 0 Storage compression is off 0x4800 0000 —Ox4FFF FFFF 
1 Storage compression is on 

10 UD10 | 0 Storage compression is off 0x5000 0000 —0x57FF FFFF 
1 Storage compression is on 

11 UD11 | 0 Storage compression is off 0x5800 0000 —Ox5FFF FFFF 
1 Storage compression is on 

12 UD12 | 0 Storage compression is off 0x6000 0000 —0x67FF FFFF 
1 Storage compression is on 

13 UD13 | 0 Storage compression is off 0x6800 0000 —Ox6FFF FFFF 
1 Storage compression is on 

14 UD14 | 0 Storage compression is off 0x7000 0000 —0x77FF FFFF 
1 Storage compression is on 

15 UD15 | 0 Storage compression is off 0x7800 0000 —0x7FFF FFFF 
1 Storage compression is on 
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SUOR (cont.) 


Storage User-Defined 0 Register 


16 


UD16 


0 Storage compression is off 
1 Storage compression is on 


0x8000 0000—0x87FF FFFF 


17 


UD17 


0 Storage compression is off 
1 Storage compression is on 


0x8800 0000—Ox8FFF FFFF 


18 


UD18 


0 Storage compression is off 
1 Storage compression is on 


0x9000 0000—0x97FF FFFF 


19 


UD19 


0 Storage compression is off 
1 Storage compression is on 


0x9800 0000—0x9FFF FFFF 


20 


UD20 


0 Storage compression is off 
1 Storage compression is on 


0xA000 0000—0xA7FF FFFF 


21 


UD21 


0 Storage compression is off 
1 Storage compression is on 


0xA800 0000—OxAFFF FFFF 


22 


UD22 


0 Storage compression is off 
1 Storage compression is on 


0xB000 0000—0xB7FF FFFF 


23 


UD23 


0 Storage compression is off 
1 Storage compression is on 


0xB800 0000—OxBFFF FFFF 


24 


UD24 


0 Storage compression is off 
1 Storage compression is on 


0xC000 0000—0xC7FF FFFF 


25 


UD25 


0 Storage compression is off 
1 Storage compression is on 


0xC800 0000—0xCFFF FFFF 


26 


UD26 


0 Storage compression is off 
1 Storage compression is on 


0xD000 0000—0xD7FF FFFF 


27 


UD27 


0 Storage compression is off 
1 Storage compression is on 


0xD800 0000—0xDFFF FFFF 


28 


UD28 


0 Storage compression is off 
1 Storage compression is on 


0xE000 0000—OxE7FF FFFF 


29 


UD29 


0 Storage compression is off 
1 Storage compression is on 


O0xE800 0000—OxEFFF FFFF 


30 


UD30 


0 Storage compression is off 
1 Storage compression is on 


OxFO00 0000 —OxF7FF FFFF 


31 


UD31 


0 Storage compression is off 
1 Storage compression is on 


OxF800 0000—OxFFFF FFFF 


Register Summary 
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TBL 


Time Base Lower 
TBR 0x10C (Read-only); SPR 0x11C (Privileged write-only) 


See “Time Base” on page 6-1. 


Figure 10-31. Time Base Lower (TBL) 


0:31 Time Base Lower Current count; low-order 32 bits of time 
base. 
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TBU 


Time Base Upper 
TBR 0x10D (Read-only); SPR 0x11D (Privileged write-only) 


See “Time Base” on page 6-1. 


Figure 10-32. Time Base Upper (TBU) 


0:31 Time Base Upper Current count, high-order 32 bits of time 
base. 
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TCR 


Timer Control Register 

SPR 0x3DA 

See “Timer Control Register (TCR)” on page 6-9. 
WP WIE FP FIE 


4 oy yy 
45/6 7/8 


31 


Figure 10-33. Timer Control Register (TCR) 


0:1 WP Watchdog Period 
00 2'” clocks 
01 21 clocks 
10 2% clocks 


11 229 clocks 


2:3 WRC._ | Watchdog Reset Control 

00 No Watchdog reset will occur. 

01 Core reset will be forced by the 
Watchdog. 

10 Chip reset will be forced by the 
Watchdog. 

11 System reset will be forced by the 
Watchdog. 


TCR[WRC] resets to 00. 

This field can be set by software, but 
cannot be cleared by software, except by a 
software-induced reset. 


4 WIE Watchdog Interrupt Enable 
0 Disable watchdog interrupt. 


1 Enable watchdog interrupt. 


5 PIE PIT Interrupt Enable 
0 Disable PIT interrupt. 


1 Enable PIT interrupt. 


6:7 FP FIT Period 
00 2° clocks 
01 2'3 clocks 
10 2'” clocks 


11 221 clocks 


8 FIE FIT Interrupt Enable 
0 Disable FIT interrupt. 


1 Enable FIT interrupt. 


9 ARE Auto Reload Enable 
0 Disable auto reload. 
1 Enable auto reload. 


Disables on reset. 


10:31 Reserved 
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TSR 


Timer Status Register 
SPR 0x3D8 Read/Clear 
See “Timer Status Register (TSR)” on page 6-8. 
ENW wWRS_ FIS 


0/1}2 4|5 31 
WIS PIS 
Figure 10-34. Timer Status Register (TSR) 
0 ENW | Enable Next Watchdog Software must reset TSR[ENW] = 0 after 
0 Action on next watchdog event is to set each watchdog timer event. 
TSR[ENW] = 1. 


1 Action on next watchdog event is 
governed by TSR[WIS]. 

1 WIS Watchdog Interrupt Status 

0 No Watchdog interrupt is pending. 

1 Watchdog interrupt is pending. 

2:3 WRS _| Watchdog Reset Status 

00 No Watchdog reset has occurred. 

01 Core reset was forced by the watchdog. 

10 Chip reset was forced by the watchdog. 

11 System reset was forced by the 

watchdog. 

4 PIS PIT Interrupt Status 

0 No PIT interrupt is pending. 

1 PIT interrupt is pending. 

5 FIS FIT Interrupt Status 

0 No FIT interrupt is pending. 

1 FIT interrupt is pending. 


6:31 Reserved 
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USPRGO 


User Special Purpose Register General 0 


SPR 0x100 (User R/W) 
See “Special Purpose Register General (SPRGO-SPRG7)” on page 2-9. 


31 


Figure 10-35. User SPR General 0 (USPRGO) 


0:31 


General data 


Software value; no hardware usage. 
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XER 


Fixed Point Exception Register 
SPR 0x001 
See “Fixed Point Exception Register (XER)” on page 2-7. 
SO CA TBC 


yy t 
0 2 


{ 


- 


OV 


Figure 10-36. Fixed Point Exception Register (XER) 


0 SO Summary Overflow Can be set by mtspr or by using “o” form 
0 No overflow has occurred. instructions; can be reset by mtspr or by 
1 Overflow has occurred. merxr. 
1 OV Overflow Can be set by mtspr or by using “o” form 
0 No overflow has occurred. instructions; can be reset by mtspr, by 
0 Overflow has occurred. merxr, or “o” form instructions. 
2 CA Carry Can be set by mtspr or arithmetic 
0 Carry has not occurred. instructions that update the CA field; can 
1 Carry has occurred. be reset by mtspr, by merxr, or by 
arithmetic instructions that update the CA 
field. 
3:24 Reserved 
25:31 | TBC Transfer Byte Count Used by Iswx and stswx; written by mtspr. 


Register Summary 10-53 


ZPR 


Zone Protection Register 


SPR 0x3B0 


See “Zone Protection” on page 7-14. 


ZO Z2 24 Z6 Z8 Z10 Z12 214 
01/2 3)/4 5/6 7/8 9/10 11}12 13)14 15)16 17/18 19) 20 21) 22 23/24 25/26 27|28 29/30 31 
Z1 23 Z5 Z7 Z11 Z13 Z15 
Figure 10-37. Zone Protection Register (ZPR) 
0:1 ZO TLB page access control for all pages in this zone. 
In the problem state (MSR[PR] = 1): In the supervisor state (MSR[PR] = 0): 
00 No access 00 Access controlled by applicable 
01 Access controlled by applicable TLB_entry[EX, WR] 
TLB_entry[EX, WR] 01 Access controlled by applicable 
10 Access controlled by applicable TLB_entry[EX, WR] 
TLB_entry[EX, WR] 10 Accessed as if execute and write 
11 Accessed as if execute and write permissions (TLB_entry[EX, WR]) are 
permissions (TLB_entry[EX, WR]) are granted 
granted 11 Accessed as if execute and write 
permissions (TLB_entry[EX, WR]) are 
granted 
2:3 Z1 See the description of ZO. 
4:5 Z2 See the description of ZO. 
6:7 Z3 See the description of ZO. 
8:9 Z4 See the description of ZO. 
10:11 | Z5 See the description of ZO. 
12:13 | Z6 See the description of ZO. 
14:15 | Z7 See the description of ZO. 
16:17 | Z8 See the description of ZO. 
18:19 | Z9 See the description of ZO. 
20:21 | Z10 See the description of ZO. 
22:23 | Z11 See the description of ZO. 
24:25 | 212 See the description of ZO. 
26:27 | 213 See the description of ZO. 
28:29 | 214 See the description of ZO. 
30:31 | Z15 See the description of ZO. 
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Appendix A. Instruction Summary 


This appendix contains PPC405 instructions summarized alphabetically and by opcode. 


“Instruction Set and Extended Mnemonics — Alphabetical” lists all PPC405 mnemonics, including 
extended mnemonics, alphabetically. A short functional description is included for each mnemonic. 


“Instructions Sorted by Opcode,” on page A-33, lists all PPC405 instructions, sorted by primary and 
secondary opcodes. Extended mnemonics are not included in the opcode list. 


“Instruction Formats,” on page A-41, illustrates the PPC405 instruction forms (allowed arrangements 
of fields within instructions). 


A.1___Instruction Set and Extended Mnemonics - Alphabetical 


Table A-1 summarizes the PPC405 instruction set, including required extended mnemonics. All 
mnemonics are listed alphabetically, without regard to whether the mnemonic is realized in hardware 
or software. When an instruction supports multiple hardware mnemonics (for example, b, ba, bl, bla 
are all forms of b), the instruction is alphabetized under the root form. The hardware instructions are 
described in detail in Chapter 9, “Instruction Set,’ which is also alphabetized under the root form. 
Chapter 9 also describes the instruction operands and notation. 


Note the following for the branch conditional mnemonic: 


Bit 4 of the BO field provides a hint about the most likely outcome of a conditional branch. (See 
“Branch Prediction” on page 2-26 for a detailed description of branch prediction.) Assemblers should 
set BO, = 0 unless a specific reason exists otherwise. In the BO field values specified in the table 
below, BO, = 0 has always been assumed. The assembler must allow the programmer to specify 
branch prediction. To do this, the assembler supports a suffixes for the conditional branch 
mnemonics: 


+ Predict branch to be taken. 
— Predict branch not to be taken. 


As specific examples, bc also could be coded as bc+ or bc-, and bne also could be coded bne+ or 
bne—. These alternate codings set BO, = 1 only if the requested prediction differs from the standard 
prediction.See “Branch Prediction” on page 2-26 for more information. 


Table A-1. PPC405 Instruction Syntax Summary 


Other Registers 
Mnemonic Operands Function Changed Page 
add RT, RA, RB__ | Add (RA) to (RB). 9-6 
add. Place result in RT. CR[CRO] 
addo XER[SO, OV] 
addo. CR[CRO] 
XER[SO, OV] 
Instruction Summary A-1 


Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
addc RT, RA, RB _ | Add (RA) to (RB). 9-7 
addc. Place result in RT. CRICRO] 
addco Place carry-out in XER[CA]. XER[SO, OV] 
addco. CR[CRO] 

XER[SO, OV] 
adde RT, RA, RB — | Add XER[CA], (RA), (RB). 9-8 
adde. Place result in RT. CR[CRO] 
addeo Place carry-out in XER[CA]. XER[SO, OV] 
addeo. CR[CRO] 
XER[SO, OV] 
addi RT, RA, IM Add EXTS(IM) to (RA|O). 9-9 
Place result in RT. 
addic RT, RA, IM Add EXTS(IM) to (RA|O). 9-10 
Place result in RT. 
Place carry-out in XER[CA]. 
addic. RT, RA, IM Add EXTS(IM) to (RA|O). CR[CRO] 9-11 
Place result in RT. 
Place carry-out in XER[CA]. 
addis RT, RA, IM Add (IM || 160) to (RA|O). 9-12 
Place result in RT. 
addme RT, RA Add XER[CA], (RA), (-1). 9-13 
addme. Place result in RT. CRICRO] 
nddine Place carry-out in XER[CA]. XER[SO, OV] 
addmeo. CR[CRO] 
XER[SO, OV] 
addze RT, RA Add XER|[CA] to (RA). 9-14 
addze. Place result in RT. CRICRO] 
addzeo Place carry-out in XER[CA]. XER[SO, OV] 
addzeo. CR[CRO] 
XER[SO, OV] 
and RA, RS, RB | AND (RS) with (RB). 9-15 
and. Place result in RA. CRICRO] 
andc RA, RS, RB | AND (RS) with —(RB). 9-16 
andc. Place result in RA. CRICRO] 
andi. RA, RS, IM AND (RS) with (760 |] IM). CR[CRO] 9-17 
Place result in RA. 
andis. RA, RS, IM AND (RS) with (IM || 0). CR[CRO] 9-18 


Place result in RA. 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 
b 


ba 


bl 


bla 


Operands 
target 


Function 


Branch unconditional relative. 
LI < (target — CIA)¢.59 
NIA — CIA + EXTS(LI || 20) 


Other Registers 
Changed 


Branch unconditional absolute. 
LI < targetg-o9 
NIA <— EXTS(LI |] 20) 


Branch unconditional relative. 
LI < (target — CIA)¢.9 
NIA — CIA + EXTS(LI || 20) 


(LR) — CIA +4. 


Branch unconditional absolute. 
LI < targetg-o9 
NIA <— EXTS(LI |] 20) 


(LR) — CIA +4. 


Page 
9-19 


be 


bca 


bel 


bela 


BO, BI, target 


Branch conditional relative. 
BD < (target — CIA) 16-29 
NIA <— CIA + EXTS(BD || 20) 


CTR if BOs = 0. 


Branch conditional absolute. 
BD < targeti¢-29 
NIA <— EXTS(BD |] 20) 


CTR if BOs = 0. 


Branch conditional relative. 
BD < (target — CIA) 16-29 
NIA <— CIA + EXTS(BD || 20) 


CTR if BO, = 0. 
(LR) — CIA +4. 


Branch conditional absolute. 
BD < targeti¢-29 
NIA <— EXTS(BD |] 20) 


CTR if BO, = 0. 
(LR) — CIA +4. 


9-20 


bectr 


bectrl 


BO, Bl 


Branch conditional to address in CTR. 
Using (CTR) at exit from instruction, 
NIA}<— CTRo.29. II'"0: 


CTR if BOs = 0. 


CTR if BO, = 0. 
(LR) — CIA +4. 


9-26 


belr 


belrl 


BO, Bl 


Branch conditional to address in LR. 
Using (LR) at entry to instruction, 
NIA <— LRo-29 || “0. 


CTR if BOs = 0. 


CTR if BO, = 0. 
(LR) — CIA +4. 


9-30 


betr 


betrl 


Branch unconditionally to address in CTR. 


Extended mnemonic for 
bccir 20,0 


Extended mnemonic for 
bccirl 20,0 


(LR) — CIA +4. 


9-26 


bdnz 


bdnza 


bdnzl 


bdnzla 


target 


Decrement CTR. 

Branch if CTR #0. 
Extended mnemonic for 
be 16,0,target 


Extended mnemonic for 
bea 16,0,target 


Extended mnemonic for 
bel 16,0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 16,0,target 


(LR) — CIA +4. 
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Instruction Summary 


Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


bdnzir 


Operands 


bdnzirl 


Function 


Decrement CTR. 

Branch if CTR # 0 to address in LR. 
Extended mnemonic for 
bclr 16,0 


Other Registers 


Changed 


Extended mnemonic for 
belrl 16,0 


(LR) — CIA +4. 


Page 
9-30 


bdnzf 


cr_bit, target 


bdnzfa 


bdnzfl 


bdnzfla 


Decrement CTR. 

Branch if CTR 0 AND CRe, pit = 0. 
Extended mnemonic for 
be 0,cr_bit,target 


Extended mnemonic for 
bea 0,cr_bit,target 


Extended mnemonic for 
bel 0,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 0,cr_bit,target 


(LR) — CIA +4. 


9-20 


bdnzfir 


cr_bit 


bdnzfirl 


Decrement CTR. 

Branch if CTR #0 AND CR, pit = 0 to address in LR. 
Extended mnemonic for 
belr 0,cr_bit 


Extended mnemonic for 
belrl 0,cr_bit 


(LR) — CIA +4. 


9-30 


bdnzt 


cr_bit, target 


bdnzta 


bdnztl 


bdnzitla 


Decrement CTR. 

Branch if CTR 0 AND CR, pit = 1. 
Extended mnemonic for — 
be 8,cr_bit,target 


Extended mnemonic for 
bea 8,cr_bit,target 


Extended mnemonic for 
bel 8,cr_bit,target 


(LR) —CIA +4. 


Extended mnemonic for 
bcla 8,cr_bit,target 


(LR) — CIA +4. 


9-20 


bdnztir 


cr_bit 


bdnztirl 


Decrement CTR. 

Branch if CTR #0 AND CR,, pi = 1 to address in LR. 
Extended mnemonic for 
belr 8,cr_bit 


Extended mnemonic for 
belrl 8,cr_bit 


(LR) — CIA +4. 


9-30 


bdz 


target 


bdza 


bdzl 


Decrement CTR. 

Branch if CTR = 0. 
Extended mnemonic for 
be 18,0,target 


Extended mnemonic for 
bea 18,0,target 


Extended mnemonic for 
bel 18,0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 18,0,target 


(LR) — CIA +4. 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 
bdzir 


bdzirl 


Operands 


Function 


Decrement CTR. 

Branch if CTR = 0 to address in LR. 
Extended mnemonic for 
belr 18,0 


Other Registers 
Changed 


Extended mnemonic for 
belrl 18,0 


(LR) — CIA +4. 


Page 
9-30 


bdzf 


bdzfa 


bdzfl 


bdzfla 


cr_bit, target 


Decrement CTR. 

Branch if CTR = 0 AND CRe pit = 0. 
Extended mnemonic for 
be 2,cr_bit,target 


Extended mnemonic for 
bea 2,cr_bit,target 


Extended mnemonic for 
bel 2,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 2,cr_bit,target 


(LR) — CIA +4. 


9-20 


bdzfir 


bdzfirl 


cr_bit 


Decrement CTR. 

Branch if CTR = 0 AND CRe, pi = 0 to address in LR. 
Extended mnemonic for 
belr 2,cr_bit 


Extended mnemonic for 
belrl 2,cr_bit 


(LR) — CIA +4. 


bdzt 


bdzta 


bdztl 


bdztla 


cr_bit, target 


Decrement CTR. 

Branch if CTR = 0 AND CR¢ pit = 1. 
Extended mnemonic for 
be 10,cr_bit,target 


Extended mnemonic for 
bea 10,cr_bit,target 


Extended mnemonic for 
bel 10,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 10,cr_bit,target 


(LR) — CIA +4. 


9-20 


bdztir 


bdztirl 


cr_bit 


Decrement CTR. 

Branch if CTR = 0 AND CR,, pit = 1to address in LR. 
Extended mnemonic for 
belr 10,cr_bit 


Extended mnemonic for 
belrl 10,cr_bit 


(LR) — CIA +4. 


9-30 


beq 


beqa 


beql 


beqla 


[cr_field], 
target 


Branch if equal. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+2,target 


Extended mnemonic for 
bea 12,4«cr_field+2,target 


Extended mnemonic for 
bel 12,4«cr_field+2,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+2,target 


(LR) — CIA +4. 


9-20 


Instruction Summary 


Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


begqctr 


beqctrl 


Operands 
[cr_field] 


Function 


Branch if equal to address in CTR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+2 


Other Registers 
Changed 


Extended mnemonic for 
bectrl 12,4*cr_field+2 


(LR) — CIA +4. 


Page 
9-26 


beqIr 


beqIrl 


[cr_field] 


Branch if equal to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4*cr_field+2 


Extended mnemonic for 
belrl 12,4«cr_field+2 


(LR) — CIA +4. 


9-30 


bf 


bfa 


bfl 


bfla 


cr_bit, target 


Branch if CRey pit = 0. 
Extended mnemonic for 
be 4,cr_bit,target 


Extended mnemonic for 
bea 4,cr_bit,target 


Extended mnemonic for 
bel 4,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 4,cr_bit,target 


(LR) — CIA +4. 


9-20 


bfctr 


bfctrl 


cr_bit 


Branch if CRer pit = 0 to address in CTR. 
Extended mnemonic for 
bectr 4,cr_bit 


Extended mnemonic for 
bectrl 4,cr_bit 


(LR) — CIA +4. 


9-26 


bfir 


bfirl 


cr_bit 


Branch if CRer pit = 0 to address in LR. 
Extended mnemonic for 
belr 4,cr_bit 


Extended mnemonic for 
belrl 4,cr_bit 


(LR) —CIA +4. 


9-30 


bge 


bgea 


bgel 


bgela 


[cr_field], 
target 


Branch if greater than or equal. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+0,target 


Extended mnemonic for 
bea 4,4«cr_field+0,target 


Extended mnemonic for 
bel 4,4«cr_field+0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 4,4«cr_field+0,target 


(LR) — CIA +4. 


9-20 


bgectr 


bgectrl 


[cr_field] 


Branch if greater than or equal to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4*cr_field+0 


Extended mnemonic for 
bectrl 4,4*cr_field+0 


(LR) — CIA +4. 


9-26 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


bgelr 


bgelrl 


Operands 
[cr_field] 


Function 


Branch if greater than or equal to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+0 


Other Registers 
Changed 


Extended mnemonic for 
belrl 4,4«cr_field+0 


(LR) — CIA +4. 


Page 
9-30 


bgt 


bgta 


bgtl 


bgtla 


[cr_field], 
target 


Branch if greater than. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+1,target 


Extended mnemonic for 
bea 12,4«cr_field+1,target 


Extended mnemonic for 
bel 12,4«cr_field+1,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+1,target 


(LR) — CIA +4. 


9-20 


bgtctr 


bgtctrl 


[cr_field] 


Branch if greater than to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 12,4«cr_field+1 


Extended mnemonic for 
bectrl 12,4«cr_field+1 


(LR) — CIA +4. 


9-26 


bgtir 


bgtirl 


[cr_field] 


Branch if greater than to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4«cr_field+1 


Extended mnemonic for 
belrl 12,4«cr_field+1 


(LR) — CIA +4. 


9-30 


ble 


blea 


blel 


blela 


[cr_field], 
target 


Branch if less than or equal. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+1,target 


Extended mnemonic for 
bea 4,4«cr_field+1,target 


Extended mnemonic for 
bel 4,4«cr_field+1,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+1,target 


(LR) — CIA +4. 


blectr 


blectrl 


[cr_field] 


Branch if less than or equal to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4*cr_field+1 


Extended mnemonic for 
bectrl 4,4*cr_field+1 


(LR) —CIA +4. 
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Instruction Summary 


Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 
blelr 


blelrl 


Operands 
[cr_field] 


Function 


Branch if less than or equal to address in LR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+1 


Other Registers 
Changed 


Extended mnemonic for 
belrl 4,4«cr_field+1 


(LR) — CIA +4. 


Page 
9-30 


bir 


birl 


Branch unconditionally to address in LR. 


Extended mnemonic for 
bclr 20,0 


Extended mnemonic for 
belrl 20,0 


(LR) — CIA +4. 


9-30 


bit 


bita 


bitl 


bitla 


[cr_field], 
target 


Branch if less than. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+0,target 


Extended mnemonic for 
bea 12,4«cr_field+0,target 


Extended mnemonic for 
bel 12,4«cr_field+0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+0,target 


(LR) —CIA +4. 


9-20 


bltctr 


bltctrl 


[cr_field] 


Branch if less than to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4*cr_field+0 


Extended mnemonic for 
bectrl 12,4*cr_field+0 


(LR) — CIA +4. 


9-26 


bitlr 


bitirl 


[cr_field] 


Branch if less than to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4«cr_field+0 


Extended mnemonic for 
belrl 12,4«cr_field+0 


(LR) — CIA +4. 


9-30 


bne 


bnea 


bnel 


bnela 


[cr_field], 
target 


Branch if not equal. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+2,target 


Extended mnemonic for 
bea 4,4«cr_field+2,target 


Extended mnemonic for 
bel 4,4«cr_field+2,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+2,target 


(LR) — CIA +4. 


9-20 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


bnectr 


bnectrl 


Operands 
[cr_field] 


Function 


Branch if not equal to address in CTR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4*cr_field+2 


Other Registers 
Changed 


Extended mnemonic for 
bectrl 4,4*cr_field+2 


(LR) — CIA +4. 


Page 
9-26 


bnelr 


bnelrl 


[cr_field] 


Branch if not equal to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+2 


Extended mnemonic for 
belrl 4,4«cr_field+2 


(LR) — CIA +4. 


9-30 


bng 


bnga 


bngl 


bngla 


[cr_field], 
target 


Branch if not greater than. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+1,target 


Extended mnemonic for 
bea 4,4«cr_field+1,target 


Extended mnemonic for 
bel 4,4«cr_field+1,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+1,target 


(LR) — CIA +4. 


9-20 


bngctr 


bngctrl 


[cr_field] 


Branch if not greater than to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4*cr_field+1 


Extended mnemonic for 
bectrl 4,4*cr_field+1 


(LR) — CIA +4. 


9-26 


bnglr 


bnglrl 


[cr_field] 


Branch if not greater than to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+1 


Extended mnemonic for 
belrl 4,4«cr_field+1 


(LR) — CIA +4. 


bnl 


bnla 


bnil 


bnila 


[cr_field], 
target 


Branch if not less than. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+0,target 


Extended mnemonic for 
bea 4,4«cr_field+0,target 


Extended mnemonic for 
bel 4,4«cr_field+0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+0,target 


(LR) — CIA +4. 


9-20 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


bnictr 


Operands 
[cr_field] 


bnictrl 


Function 


Branch if not less than to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4*cr_field+0 


Other Registers 
Changed 


Extended mnemonic for 
bectrl 4,4*cr_field+0 


(LR) — CIA +4. 


Page 
9-26 


bnilr 


[cr_field] 


bnilrl 


Branch if not less than to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+0 


Extended mnemonic for 
belrl 4,4«cr_field+0 


(LR) — CIA +4. 


9-30 


bns 


[cr_field], 
target 


bnsa 


bnsl 


bnsla 


Branch if not summary overflow. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+3,target 


Extended mnemonic for 
bea 4,4«cr_field+3,target 


Extended mnemonic for 
bel 4,4«cr_field+3,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 4,4«cr_field+3,target 


(LR) — CIA +4. 


9-20 


bnscir 


[cr_field] 


bnsctrl 


Branch if not summary overflow to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4*cr_field+3 


Extended mnemonic for 
bectrl 4,4*cr_field+3 


(LR) — CIA +4. 


9-26 


bnsir 


[cr_field] 


bnsirl 


Branch if not summary overflow to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+3 


Extended mnemonic for 
belrl 4,4«cr_field+3 


(LR) — CIA +4. 


9-30 


bnu 


[cr_field], 
target 


bnua 


bnul 


bnula 


Branch if not unordered. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+3,target 


Extended mnemonic for 
bea 4,4«cr_field+3,target 


Extended mnemonic for 
bel 4,4«cr_field+3,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+3,target 


(LR) — CIA +4. 


9-20 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


bnuctr 


bnuctrl 


Operands 
[cr_field] 


Function 


Branch if not unordered to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4*cr_field+3 


Other Registers 
Changed 


Extended mnemonic for 
bectrl 4,4*cr_field+3 


(LR) — CIA +4. 


Page 
9-26 


bnulr 


bnulrl 


[cr_field] 


Branch if not unordered to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+3 


Extended mnemonic for 
belrl 4,4«cr_field+3 


(LR) — CIA +4. 


9-30 


bso 


bsoa 


bsol 


bsola 


[cr_field], 
target 


Branch if summary overflow. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+3,target 


Extended mnemonic for 
bea 12,4«cr_field+3,target 


Extended mnemonic for 
bel 12,4«cr_field+3,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+3,target 


(LR) — CIA +4. 


9-20 


bsoctr 


bsoctrl 


[cr_field] 


Branch if summary overflow to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4*cr_field+3 


Extended mnemonic for 
bectrl 12,4«cr_field+3 


(LR) — CIA +4. 


9-26 


bsolr 


bsolrl 


[cr_field] 


Branch if summary overflow to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 12,4*cr_field+3 


Extended mnemonic for 
belrl 12,4«cr_field+3 


(LR) — CIA +4. 


bt 


bta 


btl 


btla 


cr_bit, target 


Branch if CRey pit = 1- 
Extended mnemonic for 
be 12,cr_bit,target 


Extended mnemonic for 
bea 12,cr_bit,target 


Extended mnemonic for 
bel 12,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,cr_bit,target 


(LR) —CIA +4. 


9-20 


btctr 


btctrl 


cr_bit 


Branch if CRe, pit = 1 to address in CTR. 
Extended mnemonic for 
bectr 12,cr_bit 


Extended mnemonic for 
bectrl 12,cr_bit 


(LR) — CIA +4. 


Instruction Summary 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


btir 


Operands 
cr_bit 


btirl 


Function 


Branch if CRer pit = 1, 

to address in LR. 
Extended mnemonic for 
belr 12,cr_bit 


Other Registers 


Changed 


Extended mnemonic for 
belrl 12,cr_bit 


(LR) — CIA +4. 


Page 
9-30 


bun 


[cr_field], 
target 


buna 


bunl 


bunla 


Branch if unordered. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+3,target 


Extended mnemonic for 
bea 12,4«cr_field+3,target 


Extended mnemonic for 
bel 12,4«cr_field+3,target 


(LR) — CIA +4. 


Extended mnemonic for 
bcla 12,4«cr_field+3,target 


(LR) — CIA +4. 


9-20 


bunctr 


[cr_field] 


bunctrl 


Branch if unordered to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+3 


Extended mnemonic for 
bectrl 12,4*cr_field+3 


(LR) — CIA +4. 


9-26 


bunlr 


[cr_field] 


bunlrl 


Branch if unordered, 

to address in LR. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4*cr_field+3 


Extended mnemonic for 
belrl 12,4«cr_field+3 


(LR) — CIA +4. 


9-30 


clrilwi 


RA, RS, n 


clriwi. 


Clear left immediate. (n < 32) 
(RA)o:n-1 = 99 
Extended mnemonic for 
rlwinm RA,RS,0,n,31 


Extended mnemonic for 
rlwinm. RA,RS,0,n,31 


CR[CRO] 


9-147 


clrislwi 


RA, RS, b, n 


clrislwi. 


Clear left and shift left immediate. 
(n<b<32) 


Extended mnemonic for 
rlwinm RA,RS,n,b—n,31—n 


Extended mnemonic for 
rlwinm. RA,RS,n,b—n,31—-n 


CR[CRO] 


9-147 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


clrrwi 


clrrwi. 


Operands 
RA, RS, n 


Function 


Clear right immediate. (n < 32) 
(RA)32-n:31 <— "0 
Extended mnemonic for 
rlwinm RA,RS,0,0,31—n 


Other Registers 
Changed 


Extended mnemonic for 
rlwinm. RA,RS,0,0,31—n 


CR[CRO] 


Page 
9-147 


cmp 


BF, 0, RA, RB 


Compare (RA) to (RB), signed. 
Results in CR[CRn], where n = BF. 


cmpi 


BF, 0, RA, IM 


Compare (RA) to EXTS(IM), signed. 
Results in CR[CRn], where n = BF. 


cmpl 


BF, 0, RA, RB 


Compare (RA) to (RB), unsigned. 
Results in CR[CRn], where n = BF. 


cmpli 


BF, 0, RA, IM 


Compare (RA) to (70 || IM), unsigned. 


Results in CR[CRn], where n = BF. 


cmplw 


[BF] RA, RB 


Compare Logical Word. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmpl BF,0,RA,RB 


cmplwi 


[BF] RA, IM 


Compare Logical Word Immediate. 
Use CRO if BF is omitted. 
Extended mnemonic for 
cmpli BF,0,RA,IM 


cmpw 


[BF] RA, RB 


Compare Word. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmp BF,0,RA,RB 


9-34 


cmpwi 


[BF] RA, IM 


Compare Word Immediate. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmpi BF,0,RA,IM 


cntlzw 


cntlzw. 


RA, RS 


Count leading zeros in RS. 
Place result in RA. 


CR[CRO] 


crand 


BT, BA, BB 


AND bit (CRga) with (CRgp). 
Place result in CRear. 


crandc 


BT, BA, BB 


AND bit (CRga) with —(CRepp)- 
Place result in CRer. 


9-40 


crelr 


bx 


Condition register clear. 
Extended mnemonic for 
crxor bx,bx,bx 


9-46 


creqv 


BT, BA, BB 


Equivalence of bit CRg, with CRap. 
CRet e— =(CRea >) CRegp) 


9-44 


crmove 


bx, by 


Condition register move. 
Extended mnemonic for 
cror bx,by,by 


9-44 


crnand 


BT, BA, BB 


NAND bit (CRga) with (CRgp)- 
Place result in CRpr. 


9-42 


Instruction Summary 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 
Mnemonic Operands Function Changed Page 
crnor BT, BA, BB NOR bit (CRega) with (CRgp).- 9-43 
Place result in CRer. 
crnot bx, by Condition register not. 9-43 
Extended mnemonic for 
crnor bx,by,by 
cror BT, BA, BB OR bit (CRga) with (CRap). 9-44 
Place result in CRer. 
crore BT, BA, BB OR bit (CRaa) with —=(CRgp). 9-45 
Place result in CRer. 
crset bx Condition register set. 9-41 
Extended mnemonic for 
creqv bx,bx,bx 
crxor BT, BA, BB XOR bit (CRga) with (CRgp). 9-46 
Place result in CRar. 
dcba RA, RB Speculatively establish the data cache block which 9-47 
contains the effective address (RA|O) + (RB). 
dcbf RA, RB Flush (store, then invalidate) the data cache block 9-49 
which contains the effective address (RA|O) + (RB). 
dcbi RA, RB Invalidate the data cache block which contains the 9-50 
effective address (RA|0) + (RB). 
dcbst RA, RB Store the data cache block which contains the 9-51 
effective address (RA|0) + (RB). 
dcbt RA, RB Load the data cache block which contains the effective 9-52 
address (RA|O) + (RB). 
dcbtst RA,RB Load the data cache block which contains the effective 9-53 
address (RA|0) + (RB). 
dcbz RA, RB Zero the data cache block which contains the effective 9-54 
address (RA|O) + (RB). 
dccci RA, RB Invalidate the data cache congruence class 9-56 
associated with the effective address (RAO) + (RB). 
dcread RT, RA, RB Read either tag or data information from the data 9-57 
cache congruence class associated with the effective 
address (RA|0) + (RB). 
Place the results in RT. 
divw RT, RA, RB Divide (RA) by (RB), signed. 9-59 
divw. Place result in RT. CRICRO] 
divwo XER[SO, OV] 
divwo. CR[CRO] 
XER[SO, OV] 
divwu RT, RA, RB Divide (RA) by (RB), unsigned. 9-60 
divwu. Place result in RT. CR[CRO] 
divwuo XER[SO, OV] 
divwuo. CR[CRO] 
XER[SO, OV] 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


eieio 


Operands 


Function 


Storage synchronization. All loads and stores that 
precede the eieio instruction complete before any 
loads and stores that follow the instruction access 
main storage. 

Implemented as sync, which is more restrictive. 


Other Registers 
Changed 


Page 
9-61 


eqv 


eqv. 


RA, RS, RB 


Equivalence of (RS) with (RB). 
(RA) <— —((RS) © (RB)) 


CR[CRO] 


9-62 


extlwi 


extlwi. 


RA, RS, n, b 


Extract and left justify immediate. (n > 0) 
(RA)o:n1 Sm (R )p:bent 
(RA)n:31 < 20 

Extended mnemonic for 

rlwinm RA,RS,b,0,n-1 


Extended mnemonic for 
rlwinm. RA,RS,b,0,n—1 


CR[CRO] 


9-60 


extrwi 


extrwi. 


RA, RS, n, b 


Extract and right justify immediate. (n > 0) 
(RA)32-n:31 — (RS)p-ban-1 
(RA)o:31-n < 2 "0 

Extended mnemonic for 

rlwinm RA,RS,b+n,32-n,31 


Extended mnemonic for 
rlwinm. RA,RS,b+n,32-n,31 


CR[CRO] 


9-147 


extsb 


extsb. 


RA, RS 


Extend the sign of byte (RS)»4.31. 
Place the result in RA. 


CR[CRO] 


9-63 


extsh 


extsh. 


RA, RS 


Extend the sign of halfword (RS)46-31. 
Place the result in RA. 


CR[CRO] 


9-64 


icbi 


RA, RB 


Invalidate the instruction cache block which contains 
the effective address (RA|0) + (RB). 


9-65 


icbt 


RA, RB 


Load the instruction cache block which contains the 
effective address (RA|0) + (RB). 


9-66 


iccci 


RA, RB 


Invalidate instruction cache. 


9-67 


icread 


RA, RB 


Read either tag or data information from the 
instruction cache congruence class associated with 
the effective address (RA|0) + (RB). 

Place the results in ICDBDR. 


9-68 


inslwi 


inslwi. 


RA, RS, n, b 


Insert from left immediate. (n > 0) 
(RA)b:b+n-1 <— (RS)o:n-1 
Extended mnemonic for 
rlwimi RA,RS,32-b,b,b+n-1 


Extended mnemonic for 
rlwimi. RA,RS,32-b,b,b+n—1 


CR[CRO] 


9-146 


insrwi 


insrwi. 


RA, RS, n, b 


Insert from right immediate. (n > 0) 
(RA)b:bsn—1 <— (RS)39-n:31 
Extended mnemonic for 
rlwimi RA,RS,32-—b-n,b,b+n-1 


Extended mnemonic for 
rlwimi. RA,RS,32—-b-n,b,b+n-1 


CR[CRO] 


9-146 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


isync 


Operands 


Function 


Synchronize execution context by flushing the prefetch 
queue. 


Other Registers 


Changed 


Page 
9-70 


la 


RT, D(RA) 


Load address. (RA + 0) 
D is an offset from a base address that is assumed to 
be (RA). 
(RT) < (RA) + EXTS(D) 
Extended mnemonic for 
addi RT,RA,D 


9-9 


Ibz 


RT, D(RA) 


Load byte from EA = (RA|O) + EXTS(D) and pad left 
with zeroes, 
(RT) <— 740 || MS(EA,1). 


9-71 


Ibzu 


RT, D(RA) 


Load byte from EA = (RA|O) + EXTS(D) and pad left 
with zeroes, 

(RT) <— 40 || MS(EA,1). 

Update the base address, 

(RA) <— EA. 


9-72 


Ibzux 


RT, RA, RB 


Load byte from EA = (RA|0) + (RB) and pad left with 
zeroes, 

(RT) <— 740 || MS(EA,1). 

Update the base address, 

(RA) <— EA. 


9-73 


Ibzx 


RT, RA, RB 


Load byte from EA = (RA|0) + (RB) and pad left with 
zeroes, 
(RT) <— 40 || MS(EA,1). 


9-74 


lha 


RT, D(RA) 


Load halfword from EA = (RA|0) + EXTS(D) and sign 
extend, 
(RT) — EXTS(MS(EA,2)). 


9-75 


Ihau 


RT, D(RA) 


Load halfword from EA = (RA|0) + EXTS(D) and sign 
extend, 

(RT) — EXTS(MS(EA,2)). 

Update the base address, 

(RA) < EA. 


9-76 


Ihaux 


RT, RA, RB 


Load halfword from EA = (RA|0) + (RB) and sign 
extend, 

(RT) — EXTS(MS(EA,2)). 

Update the base address, 

(RA) < EA. 


9-77 


Ihax 


RT, RA, RB 


Load halfword from EA = (RA|0) + (RB) and sign 
extend, 
(RT) <— EXTS(MS(EA,2)). 


9-78 


Ihbrx 


RT, RA, RB 


Load halfword from EA = (RA|0) + (RB), then reverse 
byte order and pad left with zeroes, 
(RT) — 180 || MS(EA+1,1) || MS(EA,1). 


9-79 


Ihz 


RT, D(RA) 


Load halfword from EA = (RA|0) + EXTS(D) and pad 
left with zeroes, 
(RT) — 180 || MS(EA,2). 


9-80 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
Ihzu RT, D(RA) Load halfword from EA = (RA|0) + EXTS(D) and pad 9-81 
left with zeroes, 
(RT) — 180 || MS(EA,2). 
Update the base address, 
(RA) <— EA. 
Ihzux RT, RA, RB Load halfword from EA = (RA|0) + (RB) and pad left 9-82 
with zeroes, 
(RT) — 180 || MS(EA,2). 
Update the base address, 
(RA) <— EA. 
Ihzx RT, RA, RB Load halfword from EA = (RA|0) + (RB) and pad left 9-83 
with zeroes, 
(RT) — 180 || MS(EA,2). 
li RT, IM Load immediate. 9-9 
(RT) < EXTS(IM) 
Extended mnemonic for 
addi RT,0,value 
lis RT, IM Load immediate shifted. 9-12 
(RT) < (IM || 10) 
Extended mnemonic for 
addis RT,0,value 
Imw RT, D(RA) Load multiple words starting from 9-84 
EA = (RA|O) + EXTS(D). 
Place into consecutive registers RT through GPR(81). 
RA is not altered unless RA = GPR(31). 
Iswi RT, RA, NB Load consecutive bytes from EA=(RA|0). 9-85 
Number of bytes n=32 if NB=0, else n=NB. 
Stack bytes into words in CEIL(n/4) 
consecutive registers starting with RT, to 
Reina < ((RT + CEIL(n/4) -— 1) % 32). 
GPR(0) is consecutive to GPR(31). 
RA is not altered unless RA = Reya_- 
Iswx RT, RA, RB Load consecutive bytes from EA=(RA|0)+(RB). 9-87 
Number of bytes n=XER[TBC]. 
Stack bytes into words in CEIL(n/4) 
consecutive registers starting with RT, to 
Reina < ((RT + CEIL(n/4) — 1) % 32). 
GPR(0) is consecutive to GPR(31). 
RA is not altered unless RA = Reya_- 
RB is not altered unless RB = Reya_- 
If n=0, content of RT is undefined. 
lwarx RT, RA, RB Load word from EA = (RA|0) + (RB) and place in RT, 9-89 
(RT) < MS(EA,4). 
Set the Reservation bit. 
Iwbrx RT, RA, RB Load word from EA = (RA|0) + (RB) then reverse byte 9-90 
order, 
(RT) — MS(EA+3,1) || MS(EA+2,1) || 
MS(EA+1,1) || MS(EA,1). 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
lwz RT, D(RA) Load word from EA = (RA|O) + EXTS(D) and place in 9-91 
RT, 
(RT) < MS(EA,4). 
lwzu RT, D(RA) Load word from EA = (RA|O) + EXTS(D) and place in 9-92 
RT, 
(RT) < MS(EA,4). 
Update the base address, 
(RA) <— EA. 
Iwzux RT, RA, RB Load word from EA = (RA|0) + (RB) and place in RT, 9-93 
(RT) < MS(EA,4). 
Update the base address, 
(RA) <— EA. 
lwzx RT, RA, RB Load word from EA = (RA|0) + (RB) and place in RT, 9-94 
(RT) < MS(EA,4). 
macchw RT, RA, RB prodo-31 - (RA)16:31 X (RB)o-45 signed 9-95 
macchw. tempo:32 < prodg.31 + (RT) CR[CRO] 
macchwo (RT) <— temp}.32 XER[SO, OV] 
macchwo. CR[CRO] 
XER[SO, OV] 
macchws RT, RA, RB prody.31 << (RA)46:31 X (RB)o-45 signed 9-96 
macchws. aes eee : oe i CRICRO] 
IT ((PrOdg = 0) A 0 x emp, en 
macchwso (RT) — (RTo ll 34 (GRT,)) XER[SO, OV] 
macchwso. else (RT) ce tempy.30 CR[CRO] 
XER[SO, OV] 
macchwsu | RT,RA,RB | prodg.31 < (RA)16-31 X (RB)o-15 unsigned 9-97 
macchwsu. ternPos <— prodg:31 + (RT) CRICRO] 
macchwsuo (RT) < (tempy.32 Vv ““tempo) XER[SO, OV] 
macchwsuo. CR[CRO] 
XER[SO, OV] 
macchwu RT, RA, RB prod.31 << (RA)16:31 X (RB)9-15 unsigned 9-98 
macchwu. tempo:32 < prodg.31 + (RT) CR[CRO] 
macchwuo (RT) <— tempy.30 XER[SO, OV] 
macchwuo. CR[CRO] 
XER[SO, OV] 
machhw RT, RA, RB prodg:45 — (RA)16:31 Xx (RB)o-15 signed 9-99 
machhw. oe < prodg.31 + (RT) CRI[CRO] 
machhwo (RT) <— tempy.32 XER[SO, OV] 
machhwo. CR[CRO] 
XER[SO, OV] 
machhws RT, RA, RB prody-31 << (RA)9-15 X (RB)9-45 signed 9-100 
machhws. Noo eae oy ih CRICRO] 
IT ((Prodg = 0) A 0 x emp, en 
machhwso (RT) — (RTo | 31 (GRT,)) XER[SO, OV] 
machhwso. else (RT) < tempy-39 CR[CRO] 
XER[SO, OV] 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
machhwsu_ |RT,RA, RB | prodg-31 < (RA)o-15 X (RB)g-45 unsigned 9-101 
machhwsu. TEMPoigs © Proda gi 5 (RU CR[CRO] 
machhwsuo (RT) < (tempy.g2 V ““tempg) XER[SO, OV] 
machhwsuo. CR[CRO] 

XER[SO, OV] 
machhwu RT, RA, RB prodg:31 < (RA)o-15 X (RB)o-15 unsigned 9-102 
machhwu. tempo-32 < prodg.31 + (RT) CRICRO] 
machhwuo (RT) <— tempy.39 XER[SO, OV] 
machhwuo. CR[CRO] 
XER[SO, OV] 
maclhw RT, RA, RB prodo.31 << (RA)16:31 X (RB) 16-31 signed 9-103 
maclhw. tempo-32 < prodg.3; + (RT) CRICRO] 
maclhwo (RT) <— temp}.32 XER[SO, OV] 
maclhwo. CR[CRO] 
XER[SO, OV] 
maclhws RT, RA, RB prodo.31 << (RA)46-31 X (RB) 16:31 signed 9-104 
maclhws. Be See : (RT) oe CRI[CRO] 
if ((prodg = RT) A 9 # tempj)) then 
maclhwso (RT) < (RT || 31 (RT )) XER[SO, OV] 
0 0 
maclhwso. else (RT) < tempy-39 CR[CRO] 
XER[SO, OV] 
maclhwsu RT, RA, RB | prodg.34 < (RA)16-31 X (RB) 196.31 unsigned 9-105 
maclihwsu. tempo:32 < prodo.31 + (RT) CRI[CRO] 
maclhwsuo (RT) < (tempy.32 V ““tempo) XER[SO, OV] 
maclhwsuo. CR[CRO] 
XER[SO, OV] 
maclhwu RT, RA, RB __ | prodg.31 < (RA)16-31 X (RB)1¢.31 unsigned 9-106 
macihwu. tempo-32 < prodg.31 + (RT) CRI[CRO] 
maclhwuo (RT) <— tempy.39 XER[SO, OV] 
maclhwuo. CR[CRO] 
XER[SO, OV] 
merf BF, BFA Move CR field, (CR[CRn]) <— (CR[CRm)]) 9-107 
where m < BFA and n < BF. 
merxr BF Move XER[0:3] into field CRn, where n<—BF. 9-108 
CR[CRn] < (XER[SO, OV, CA)). 
(XER[SO, OV, CA]) < °0. 
mfcr RT Move from CR to RT, 9-109 
(RT) < (CR). 
mfder RT, DCRN Move from DCR to RT, 9-110 
(RT) <— (DCR(DCRN)). 
mfmsr RT Move from MSR to RT, 9-111 
(RT) <— (MSR). 
Instruction Summary A-19 


Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 
Mnemonic Operands Function Changed Page 


mfccr0 RT Move from special purpose register (SPR) SPRN. 9-112 
mfctr Extended mnemonic for 
mfdac1 mfspr RT,SPRN 
mfdac2 See Table 10.5, “Special Purpose Registers,” on 
mfdear page 10-2 for listing of valid SPRN values. 
mfdbcrO 
mfdbcer1 
mfdbsr 
mfdccr 
mfdcewr 
mfdvc1 
mfdvc2 
mfesr 
mfevpr 
mfiac1 
mfiac2 
mfiac3 
mfiac4 
mficcr 
mficdbdr 
mflr 
mfpid 
mfpit 
mfpvr 
mfsgr 
mfsler 
mfsprgO 
mfsprg1 
mfsprg2 
mfsprg3 
mfsprg4 
mfsprg5 
mfsprg6 
mfsprg7 
mfsrrO 
mfsrr1 
mfsrr2 
mfsrr3 
mfsuOr 
mftcr 
mftsr 
mfxer 
mfzpr 


mfspr RT,SPRN _ | Move from SPR to RT, 9-112 
(RT) <— (SPR(SPRN)). 


mftb RT, TBRN __| Move from TBR to AT, 9-114 
(RT) <— (TBR(TBRN)). 


mftb RT Move the contents of TBL into RT, 9-114 
(RT) <— (TBL) 
Extended mnemonic for 
mftb RT,TBL 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 
mftbu 


Operands 
RT 


Function 


Move the contents of TBU into RT, 
(RT) < (TBU) 

Extended mnemonic for 

mftb RT,TBU 


Other Registers 
Changed 


Page 
9-114 


RT, RS 


Move register. 

(RT) < (RS) 
Extended mnemonic for 
or RT,RS,RS 


Extended mnemonic for 
or. RT,RS,RS 


CR[CRO] 


9-140 


RS 


Move to Condition Register. 
Extended mnemonic for 
micrf OxFF,RS 


9-116 


micrf 


FXM, RS 


Move some or all of the contents of RS into CR as 
specified by FXM field, 
mask < 4(FXM,) || 4(FXM;) |I -.- II 
“(FXMs) || 4(FXMz). 
(CR)<((RS) A mask) v (CR) A —mask). 


9-116 


midcr 


DCRN, RS 


Move to DCR from RS, 
(DCR(DCRN)) < (RS). 


9-117 


mtmsr 


RS 


Move to MSR from RS, 
(MSR) < (RS). 


9-118 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


mtccrO 
mtctr 
mtdac1 
mtdac2 
mtdbcr0 
mtdber1 
mtdbsr 
mtdccr 
mtdear 
mtdewr 
mtdvc1 
mtdvc2 
mtesr 
mtevpr 
mtiac1 
mtiac2 
mtiac3 
mtiac4 
mticcr 
mticdbdr 
miir 
mtpid 
mtpit 
mipvr 
mtsgr 
mtsler 
mtsprgO 
mtsprg1 
mtsprg2 
mtsprg3 
mtsprg4 
mtsprg5 
mtsprg6 
mtsprg7 
mtsrrO 
mtsrr1 
misrr2 
mtsrr3 
mtsu0r 
mttbl 
mttbu 
mticr 
mttsr 
mtxer 
mizpr 


Operands 
RS 


Function 


Move to SPR SPRN. 
Extended mnemonic for 
mtspr SPRN,RS 


See Table 10.5, “Special Purpose Registers,” on 
page 10-2 for listing of valid SPRN values. 


Other Registers 


Changed 


Page 
9-119 


mtspr 


SPRN, RS 


Move to SPR from RS, 
(SPR(SPRN)) <— (RS). 


9-119 


mulchw 


mulchw. 


RT, RA, RB 


(RT)o:31 < (RA)16:31 X (RB)o-15 signed 


CR[CRO] 


9-121 


mulchwu 


mulchwu. 


RT, RA, RB 


(RT)9:31 < (RA)16:31 X (RB)o-15 unsigned 


CR[CRO] 


9-122 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
mulhhw RT, RA, RB | (RT)o-31 < (RA)o-15 X (RB)9-45 signed 9-123 
mulhhw. CR[CRO] 
mulhhwu RT, RA, RB | (RT)9-31 < (RA)o-15 X (RB)o.45 unsigned 9-124 
mulhhwu. CR[CRO] 
mullhw RT, RA, RB (RT)o-31 << (RA) 16:31 X (RB) 46-31 signed 9-125 
mullhw. CR[CRO] 
mullhwu RT, RA, RB (RT) 46-31 << (RA) 16:31 X (RB) 46-31 unsigned 9-126 
mullhwu. CR[CRO] 
mulhw RT, RA, RB Multiply (RA) and (RB), signed. 9-127 
mulhw. Place high-order result in RT. CRICRO] 

prodg.63 <— (RA) x (RB) (signed). 
(RT) <— prodg:31. 
mulhwu RT, RA, RB Multiply (RA) and (RB), unsigned. 9-128 
mulhwu. Place high-order result in RT. CRICRO] 
prodg.63 <— (RA) x (RB) (unsigned). 
(RT) <— prodg:3. 
mulli RT, RA, IM Multiply (RA) and IM, signed. 9-129 
Place low-order result in RT. 
prodg.47 < (RA) x IM (signed) 
(RT) <— prody¢-47 
mullw RT, RA, RB Multiply (RA) and (RB), signed. 9-130 
mullw. Place low-order result in RT. CRICRO] 
mullwo prodg.63 <— (RA) x (RB) (signed). XER[SO, OV] 
(RT) <— prodga:¢3, : 
mullwo. CR[CRO] 
XER[SO, OV] 
nand RA, RS, RB | NAND (RS) with (RB). 9-131 
nand. Place result in RA. CRICRO] 
neg RT, RA Negative (twos complement) of RA. 9-132 
neg. (RT) <- —(RA) + 1 CR[CRO] 
nego XER[SO, OV] 
nego. CR[CRO] 
XER[SO, OV] 
nmacchw RT, RA, RB nprodo.31 << —((RA) 16-31 X (RB)9-45) signed 9-133 
nmacchw. tempo.32 < nprodg-31 + (RT) CRI[CRO] 
nmacchwo (RT) <— temp}.39 XER[SO, OV] 
nmacchwo. CR[CRO] 
XER[SO, OV] 
nmacchws RT, RA, RB nprodo.31 - —((RA) 16-31 X (RB)9-15) signed 9-134 
nmacchws. hee = es (RT) gh CR[CRO] 
if ((Nprodg = A 9 # tempy)) then 
nmacchwso XER[SO, OV 
bd (RT) < (RTo [| 8'(ARTo)) Sees 
nmacchwso. else (RT) eG temp4-30 CR[CRO] 
XER[SO, OV] 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
nmachhw RT, RA, RB | nprodo-31 <— —((RA)g-15 X (RB)g-15) signed 9-135 
nmachhw. tempo.32 < nprodg.3; + (RT) CR[CRO] 
nmachhwo (RT) <— tempy.32 XER[SO, OV] 
nmachhwo. CR[CRO] 

XER[SO, OV] 
nmachhws__| RT, RA, RB nprody-31 < —((RA)o-15 X (RB)9-15) signed 9-137 
nmachhws. tempo:32 <— Nprodg;31 + (RT) CRICRO] 
nmacnhwee i ae RTq) A (RTg # temp,)) then (RT) < (RT9 XER[SO, OV] 
UW "9 
nmachhwso. else (RT) < tempy-39 CR[CRO] 
XER[SO, OV] 
nmachlw RT, RA, RB nprodo.31 << —((RA) 16:31 X (RB) 46:31) signed 9-138 
nmachiw. tempo:32 — nprodg.31 + (RT) CRI[CRO] 
Himnachiwe if \nprodg = RTg) A (RTg # temp,)) then (RT) < (RT9 XER[SO, OV] 
I| “(ART )) 
XER[SO, OV] 
nmachlws_ | RT,RA, RB | nprodg.31 <- —((RA)9-15 X (RB)9-15) signed 9-136 
nmachiws. tempo:32 — nprodg.31 + (RT) CR[CRO] 
Findehinea i Shae RT) A (RTo # temp,)) then (RT) < (RT9 XER[SO, OV] 
nmachlwso. else (RT) < tempy-39 CR[CRO] 
XER[SO, OV] 
nop Preferred no-op, triggers optimizations based on 9-134 
no-ops. 
Extended mnemonic for 
ori 0,0,0 
nor RA, RS, RB | NOR (RS) with (RB). 9-139 
nor. Place result in RA. CR[CRO] 
not RA, RS Complement register. 9-139 
(RA) < —(RS) 
Extended mnemonic for 
nor RA,RS,RS 
not. Extended mnemonic for CR[CRO] 
nor. RA,RS,RS 
or RA, RS, RB | OR (RS) with (RB). 9-134 
or. Place result in RA. CRICRO] 
orc RA, RS, RB | OR (RS) with —(RB). 9-134 
ore. Place result in RA. CRICRO] 
ori RA, RS, IM OR (RS) with (70 || IM). 9-134 
Place result in RA. 
oris RA, RS, IM OR (RS) with (IM || ‘0). 9-143 
Place result in RA. 
rfci Return from critical interrupt 9-144 
(PC) <— (SRR2). 
(MSR) <— (SRR38). 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


rfi 


Operands 


Function 
Return from interrupt. 
(PC) < (SRRO). 
(MSR) <— (SRRY1). 


Other Registers 


Changed 


Page 
9-145 


rlwimi 


rlwimi. 


RA, RS, SH, 
MB, ME 


Rotate left word immediate, then insert according to 


mask. 

r <— ROTL((RS), SH) 

m < MASK(MB, ME) 

(RA) < (rA m) v ((RA) A =m) 


CR[CRO] 


9-146 


rlwinm 


rlwinm. 


RA, RS, SH, 
MB, ME 


Rotate left word immediate, then AND with mask. 
r < ROTL((RS), SH) 

m < MASK(MB, ME) 

(RA) < (ra m) 


CR[CRO] 


9-147 


rlwnm 


rlwnm. 


RA, RS, RB, 
MB, ME 


Rotate left word, then AND with mask. 
r <— ROTL((RS), (RB)27-.31) 

m < MASK(MB, ME) 

(RA) < (ra m) 


CR[CRO] 


9-150 


rotlw 


rotlw. 


RA, RS, RB 


Rotate left. 

(RA) <— ROTL((RS), (RB)27.31) 
Extended mnemonic for 
rlwnm RA,RS,RB,0,31 


Extended mnemonic for 
rlwnm. RA,RS,RB,0,31 


CR[CRO] 


9-150 


rotlwi 


rotlwi. 


RA, RS, n 


Rotate left immediate. 

(RA) < ROTL((RS), n) 
Extended mnemonic for 
rlwinm RA,RS§S,n,0,31 


Extended mnemonic for 
rlwinm. RA,R§S,n,0,31 


CR[CRO] 


9-147 


rotrwi 


rotrwi. 


RA, RS, n 


Rotate right immediate. 
(RA) < ROTL((RS), 32—-n) 
Extended mnemonic for 
rlwinm RA,RS,32-n,0,31 


Extended mnemonic for 
rlwinm. RA,RS,32-n,0,31 


CR[CRO] 


9-147 


sc 


System call exception is generated. 
(SRR1) — (MSR) 

(SRRO) < (PC) 

PC <— EVPRo-15 || x'0C00' 
(MSR[WE, PR, EE, PE, DR, IR]) < 0 


9-151 


slw 


slw. 


RA, RS, RB 


Shift left (RS) by (RB)o7.33. 

n <— (RB)27-.31. 

r <— ROTL((RS), n). 

if (RB)og = Othenm < MASK(O, 31 — n) 
elsem < 220, 

(RA) — ram. 


CR[CRO] 


9-152 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


slwi 


slwi. 


Operands 
RA, RS, n 


Function 


Shift left immediate. (n < 32) 
(RA)o-31-n — (RS)n:31 
(RA)32-n:31 <— "0 
Extended mnemonic for 
rlwinm RA,RS,n,0,31-n 


Other Registers 


Changed 


Extended mnemonic for 
rlwinm. RA,RS,n,0,31-n 


CR[CRO] 


Page 
9-147 


sraw 


sraw. 


RA, RS, RB 


Shift right algebraic (RS) by (RB)o7.3;. 
n <— (RB)o7:31. 

r <— ROTL((RS), 32—n). 

if (RB)og = 0 thenm <— MASK(n, 31) 
elsem < °0, 

s < (RS)o 

(RA) < (r A m) v (8s A -m). 
XER[CA] < s A ((r A =m) £0). 


CR[CRO] 


9-153 


srawi 


srawi. 


RA, RS, SH 


Shift right algebraic (RS) by SH. 

n < SH. 

r < ROTL((RS), 32 —n). 

m < MASK(n, 31). 

Ss <— (RS)o, 

(RA) < (r A m) v (8s A -m). 


CR[CRO] 


9-154 


srw 


srw. 


RA, RS, RB 


XER[CA] < s A ((r A —m)#0). 
Shift right (RS) by (RB)o7-31. 

n <= (RB)27-31. 

r <— ROTL((RS), 32—n). 

if (RB)og = 0 thenm <— MASK(n, 31) 
elsem < 220, 

(RA) ram. 


CR[CRO] 


9-155 


srwi 


srwi. 


RA, RS, n 


Shift right immediate. (n < 32) 
(RA)n31 < (RS)o:31-n 
(RA) o:n-1 "0 
Extended mnemonic for 
rlwinm RA,RS,32-n,n,31 


Extended mnemonic for 
rlwinm. RA,RS,32-n,n,31 


CR[CRO] 


9-147 


stb 


RS, D(RA) 


Store byte (RS)o4-3; in memory at 
EA = (RA|O) + EXTS(D). 


9-156 


stbu 


RS, D(RA) 


Store byte (RS)o4-31 in memory at 
EA = (RA|O) + EXTS(D). 

Update the base address, 

(RA) <— EA. 


9-157 


stbux 


RS, RA, RB 


Store byte (RS)o4-31 in memory at 
EA = (RA|O) + (RB). 

Update the base address, 

(RA) <— EA. 


9-158 


stbx 


RS, RA, RB 


Store byte (RS)o4-31 in memory at 
EA = (RA|O) + (RB). 


9-159 


sth 


RS, D(RA) 


Store halfword (RS)¥-31 in memory at 
EA = (RA|O) + EXTS(D). 


9-160 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 
sthbrx 


Operands 
RS, RA, RB 


Function 
Store halfword (RS)¥¢.3, byte-reversed in memory at 
EA = (RA|O) + (RB). 
MS(EA, 2) <— (RS)oq:31 Il (RS) 16:23 


Other Registers 


Changed 


Page 
9-161 


sthu 


RS, D(RA) 


Store halfword (RS)¥¢.31 in memory at 
EA = (RA|O) + EXTS(D). 

Update the base address, 

(RA) <— EA. 


9-162 


sthux 


RS, RA, RB 


Store halfword (RS)¥¢.31 in memory at 
EA = (RA|O) + (RB). 

Update the base address, 

(RA) < EA. 


9-163 


sthx 


RS, RA, RB 


Store halfword (RS)4¢-31 in memory at 
EA = (RA|O) + (RB). 


9-164 


stmw 


RS, D(RA) 


Store consecutive words from RS through GPR(31) in 
memory starting at 
EA = (RA|O) + EXTS(D). 


9-165 


stswi 


RS, RA, NB 


Store consecutive bytes in memory starting at 
EA=(RA|0). 

Number of bytes n=32 if NB=0, else n=NB. 
Bytes are unstacked from CEIL(n/4) 
consecutive registers starting with RS. 
GPR(0) is consecutive to GPR(31). 


9-166 


stswx 


RS, RA, RB 


Store consecutive bytes in memory starting at 
EA=(RA|0)+(RB). 

Number of bytes n=XER[TBC]. 

Bytes are unstacked from CEIL(n/4) 
consecutive registers starting with RS. 
GPR(0) is consecutive to GPR(31). 


9-167 


stw 


RS, D(RA) 


Store word (RS) in memory at 
EA = (RA|O) + EXTS(D). 


9-169 


stwbrx 


RS, RA, RB 


Store word (RS) byte-reversed in memory at 

EA = (RA|O) + (RB). 

MS(EA, 4) <— (RS)oq:31 Il (RS)16:23 Il 
(RS)g-15 Il (RS)o.7 


9-170 


stwex. 


RS, RA, RB 


Store word (RS) in memory at EA = (RA|O) + (RB) 
only if reservation bit is set. 
if RESERVE = 1 then 
MS(EA, 4) < (RS) 
RESERVE < 0 
(CR[CRO]) < 70 || 1 || XER,, 
else 
(CR[CRO]) < 70 || 0 || XER«o, 


9-171 


stwu 


RS, D(RA) 


Store word (RS) in memory at 
EA = (RA|O) + EXTS(D). 
Update the base address, 
(RA) <— EA. 


9-173 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
stwux RS, RA, RB | Store word (RS) in memory at 9-174 
EA = (RA|O) + (RB). 
Update the base address, 
(RA) <— EA. 
stwx RS, RA, RB _ | Store word (RS) in memory at 9-175 
EA = (RA|O) + (RB). 
sub RT, RA, RB | Subtract (RB) from (RA). 9-176 
(RT) < —(RB) + (RA) + 1. 
Extended mnemonic for 
subf RT,RB,RA 
sub. Extended mnemonic for CR[CRO] 
subf. RT,RB,RA 
subo Extended mnemonic for XER[SO, OV] 
subfo RT,RB,RA 
subo. Extended mnemonic for CR[CRO] 
subfo. RT,RB,RA XER[SO, OV] 
subc RT, RA, RB Subtract (RB) from (RA). 9-177 
(RT) < —(RB) + (RA) + 1. 
Place carry-out in XER[CA]. 
Extended mnemonic for 
subfc RT,RB,RA 
subc. Extended mnemonic for CR[CRO] 
subfc. RT,RB,RA 
subco Extended mnemonic for XER[SO, OV] 
subfco RT,RB,RA 
subco. Extended mnemonic for CR[CRO] 
subfco. RT,RB,RA XER[SO, OV] 
subf RT, RA, RB | Subtract (RA) from (RB). 9-176 
subf. (RT) < —(RA) + (RB) +1. CR[CRO] 
subfo XER[SO, OV] 
subfo. CR[CRO] 
XER[SO, OV] 
subfc RT, RA, RB | Subtract (RA) from (RB). 9-177 
subfc. (RT) < —(RA) + (RB) +1. CRICRO] 
Subico Place carry-out in XER[CA]. XER[SO, OV] 
subfco. CR[CRO] 
XER[SO, OV] 
subfe RT, RA, RB Subtract (RA) from (RB) with carry-in. 9-178 
subfe. (RT) <— -—(RA) ba (RB) + XER[CA]. CRI[CRO] 
SUbieO Place carry-out in XER[CA]. XER[SO, OV] 
subfeo. CR[CRO] 
XER[SO, OV] 
subfic RT, RA, IM Subtract (RA) from EXTS(IM). 9-179 


(RT) < —(RA) + EXTS(IM) + 1. 
Place carry-out in XER[CA]. 


A-28 PPC405 Core User’s Manual 


Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


subfme 


subfme. 


subfmeo 


subfmeo. 


Operands 
RT, RA, RB 


Function 
Subtract (RA) from (—1) with carry-in. 
(RT) < —(RA) + (-1) + XER[CA]. 
Place carry-out in XER[CA]. 


Other Registers 


Changed 


CR[CRO] 


XER[SO, OV] 


CRICRO] 
XER[SO, OV] 


Page 
9-180 


subfze 


subfze. 


subfzeo 


subfzeo. 


RT, RA, RB 


Subtract (RA) from zero with carry-in. 
(RT) < —(RA) + XER[CA]. 
Place carry-out in XER[CA]. 


CR[CRO] 


XER[SO, OV] 


CRICRO] 
XER[SO, OV] 


9-181 


subi 


RT, RA, IM 


Subtract EXTS(IM) from (RAO). 
Place result in RT. 

Extended mnemonic for 

addi RT,RA,—IM 


9-9 


subic 


RT, RA, IM 


Subtract EXTS(IM) from (RA). 

Place result in RT. 

Place carry-out in XER[CA]. 
Extended mnemonic for 
addic RT,RA,-IM 


9-10 


subic. 


RT, RA, IM 


Subtract EXTS(IM) from (RA). 

Place result in RT. 

Place carry-out in XER[CA]. 
Extended mnemonic for 
addic. RT,RA,—IM 


CR[CRO] 


9-11 


subis 


RT, RA, IM 


Subtract (IM || 0) from (RA|O). 
Place result in RT. 

Extended mnemonic for 

addis RT,RA,—IM 


9-12 


sync 


Synchronization. All instructions that precede sync 
complete before any instructions that follow sync 
begin. 

When sync completes, all storage accesses initiated 
prior to sync will have completed. 


9-182 


tlbia 


All TLB entries are invalidated and become 
unavailable for translation by clearing the valid (V) bit 
in the TLBHI portion of each TLB entry. The rest of the 
TLB fields unmodified. 


9-183 


tlbre 


RT, RA,WS 


If WS = 0: 

Load TLBHI of the selected TLB entry into RT. 
Load PID with the contents of the TID field of the 
selected TLB entry. 

(RT) <— TLBHI[(RA)] 

(PID) <— TLB[(RA)]tip 


If WS = 1: 
Load TLBLO portion of the selected TLB entry into RT. 
(RT) < TLBLO[(RA)] 


9-184 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 
tlbrehi 


Operands 
RT, RA 


Function 


Load TLBHI of the selected TLB entry into RT. 
Load PID with the contents of the TID field of the 
selected TLB entry. 
(RT) <— TLBHI[(RA)] 
(PID) <— TLB[(RA)]tip 

Extended mnemonic for 

tlbre RT,RA,O 


Other Registers 
Changed 


Page 
9-184 


tlbrelo 


RT, RA 


Load TLBLO of the selected TLB entry into RT. 
(RT) < TLBLOJ[(RA)] 

Extended mnemonic for 

tlbre RT,RA,1 


9-184 


tlbsx 


tlbsx. 


RT, RA, RB 


Search the TLB for a valid entry that translates the EA. 
EA = (RA|O) + (RB). 
If found, 
(RT) < Index of TLB entry. 
If not found, 
(RT) Undefined. 


If found, 

(RT) < Index of TLB entry. 
If not found, 

(RT) Undefined. 


CRICRO]it.etso 


9-186 


tlbsync 


tlbsync does not complete until all previous TLB- 
update instructions executed by this processor have 
been received and completed by all other processors. 
For the PPC405 core, tlbsync is a no-op. 


9-187 


tlbwe 


RS, RA,WS 


If WS = 0: 

Write TLBHI of the selected TLB entry from RS. 
Write the TID field of the selected TLB entry from the 
PID register. 

TLBHI[(RA)] <— (RS) 

TLB[(RA)Itip <— (PID) 24:31 

If WS = 1: 

Write TLBLO portion of the selected TLB entry from 
RS. 

TLBLO[(RA)] < (RS) 


9-188 


tlbwehi 


RS, RA 


Write TLBHI of the selected TLB entry from RS. 
Write the TID field of the selected TLB entry from the 
PID register. 
TLBHI[(RA)] < (RS) 
TLB[(RA)Itip <— (PID)24:31 

Extended mnemonic for 

tlbwe RS,RA,O 


9-188 


tlbwelo 


RS, RA 


Write TLBLO of the selected TLB entry from RS. 
TLBLO[(RA)] < (RS) 

Extended mnemonic for 

tlbwe RS,RA,1 


9-188 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


trap 


Operands 


Function 


Trap unconditionally. 
Extended mnemonic for 
tw 31,0,0 


tweq 


twge 


twgt 


twle 


twige 


twigt 


twlle 


twillt 


twing 


twinl 


twit 


twne 


RA, RB 


Trap if (RA) equal to (RB). 
Extended mnemonic for 
tw 4,RA,RB 


Trap if (RA) greater than or equal to (RB). 
Extended mnemonic for 
tw 12,RA,RB 


Trap if (RA) greater than (RB). 
Extended mnemonic for 
tw 8,RA,RB 


Trap if (RA) less than or equal to (RB). 
Extended mnemonic for 
tw 20,RA,RB 


Trap if (RA) logically greater than or equal to (RB). 
Extended mnemonic for 
tw 5,RA,RB 


Trap if (RA) logically greater than (RB). 
Extended mnemonic for 
tw 1,RA,RB 


Trap if (RA) logically less than or equal to (RB). 
Extended mnemonic for 
tw 6,RA,RB 


Trap if (RA) logically less than (RB). 
Extended mnemonic for 
tw 2,RA,RB 


Trap if (RA) logically not greater than (RB). 
Extended mnemonic for 
tw 6,RA,RB 


Trap if (RA) logically not less than (RB). 
Extended mnemonic for 
tw 5,RA,RB 


Trap if (RA) less than (RB). 
Extended mnemonic for 
tw 16,RA,RB 


Trap if (RA) not equal to (RB). 
Extended mnemonic for 
tw 24,RA,RB 


Trap if (RA) not greater than (RB). 
Extended mnemonic for 
tw 20,RA,RB 


Trap if (RA) not less than (RB). 
Extended mnemonic for 
tw 12,RA,RB 


Other Registers 
Changed 


Page 
9-190 


TO, RA, RB 


Trap exception is generated if, comparing (RA) with 
(RB), any condition specified by TO is true. 


9-190 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Mnemonic 


twedqi 


twgei 


twoti 


twlei 


twigei 


twigti 


twllei 


twilti 


twingi 


twinli 


twlti 


twnei 


twngi 


twnli 


Operands 
RA, IM 


Function 


Trap if (RA) equal to EXTS(IM). 
Extended mnemonic for 
twi 4,RA,IM 


Trap if (RA) greater than or equal to EXTS(IM). 
Extended mnemonic for 
twi 12,RA,IM 


Trap if (RA) greater than EXTS(IM). 
Extended mnemonic for 
twi 8,RA,IM 


Trap if (RA) less than or equal to EXTS(IM). 
Extended mnemonic for 
twi 20,RA,IM 


Trap if (RA) logically greater than or equal to 
EXTS(IM). 

Extended mnemonic for 

wi 5,RA,IM 


Trap if (RA) logically greater than EXTS(IM). 
Extended mnemonic for 
twi 1,RA,IM 


Trap if (RA) logically less than or equal to EXTS(IM). 
Extended mnemonic for 
twi 6,RA,IM 


Trap if (RA) logically less than EXTS(IM). 
Extended mnemonic for 
twi 2,RA,IM 


Trap if (RA) logically not greater than EXTS(IM). 
Extended mnemonic for 
twi 6,RA,IM 


Trap if (RA) logically not less than EXTS(IM). 
Extended mnemonic for 
twi 5,RA,IM 


Trap if (RA) less than EXTS(IM). 
Extended mnemonic for 
twi 16,RA,IM 


Trap if (RA) not equal to EXTS(IM). 
Extended mnemonic for 
twi 24,RA,IM 


Trap if (RA) not greater than EXTS(IM). 
Extended mnemonic for 
twi 20,RA,IM 


Trap if (RA) not less than EXTS(IM). 
Extended mnemonic for 
twi 12,RA,IM 


Other Registers 
Changed 


Page 
9-193 


twi 


TO, RA, IM 


Trap exception is generated if, comparing (RA) with 
EXTS(IM), any condition specified by TO is true. 


9-193 


wrtee 


RS 


Write value of RS;,. to MSR[EE]. 


9-196 


wrteei 


Write value of E to MSR[EE]. 


9-197 
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Table A-1. PPC405 Instruction Syntax Summary (continued) 


Other Registers 
Mnemonic Operands Function Changed Page 
xor RA, RS, RB | XOR (RS) with (RB). 9-198 
xor. Place result in RA. CRICRO] 
xori RA, RS, IM XOR (RS) with (160 || IM). 9-199 
Place result in RA. 
xoris RA, RS, IM XOR (RS) with (IM || 0). 9-200 
Place result in RA. 


A.2_ Instructions Sorted by Opcode 


All instructions are four bytes long and word aligned. All instructions have a primary opcode field 
(shown as field OPCD in Figure A-1 through Figure A-9, beginning on page A-44) in bits 0:5. Some 
instructions also have a secondary opcode field (shown as field XO in Figure A-1 through Figure A-9). 
PPC405 instructions, sorted by primary and secondary opcode, are listed in Table A-2. 


The “Form” indicated in the table refers to the arrangement of valid field combinations within the four- 
byte instruction. See “Instruction Formats,” on page A-41, for the field layouts of each form. 


Form X has a 10-bit secondary opcode field, while form XO uses only the low-order 9-bits of that field. 
Form XO uses the high-order secondary opcode bit (the tenth bit) as a variable; therefore, every 
form XO instruction really consumes two secondary opcodes from the 10-bit secondary-opcode 
space. The implicitly consumed secondary opcode is listed in parentheses for form XO instructions in 
the table below. 


Table A-2. PPC405 Instructions by Opcode 
Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 
3s | JD  |twi|TO,RA,IM |9-193 | 
4 8 Xx mulhhwu RT, RA, RB 9-124 
mulhhwu. 
4 12 (524) XO machhwu RT, RA, RB 9-98 
machhwu. 
machhwuo 
machhwuo. 
4 40 xX mulhhw RT, RA, RB 9-123 
mulhhw. 
4 44 (556) XO machhw RT, RA, RB 9-99 
machhw. 
machhwo 
machhwo. 
4 46 (558) XO nmachhw RT, RA, RB 9-135 
nmachhw. 
nmachhwo 


nmachhwo 
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Table A-2. PPC405 Instructions by Opcode (continued) 


Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 


4 76 (588) XO machhwsu_| RT, RA, RB 9-101 
machhwsu. 


machhwsuo 
machhwsuo. 


4 108 (620) | XO machhws RT, RA, RB 9-100 
machhws. 

machhwso 
machhwso. 


4 110 (622) | XO nmachhws _| RT, RA, RB 9-136 
nmachhws. 

nmachhwso 
nmachhwso. 


4 136 Xx mulchwu RT, RA, RB 9-122 
mulchwu. 


4 140 (652) | XO macchwu RT, RA, RB 9-98 
macchwu. 


macchwuo 
machhwuo. 


4 168 Xx mulchw RT, RA, RB 9-121 
mulchw. 


4 172 (684) | XO macchw RT, RA, RB 9-95 
macchw. 
macchwo 


macchwo. 


4 174 (686) | XO nmacchw RT, RA, RB 9-133 
nmacchw. 


nmacchwo 
nmacchwo. 


4 204 (716) | XO macchwsu_| RT, RA, RB 9-97 
macchwsu. 
macchwsuo 


macchwsuo. 


4 236 (748) | XO macchws RT, RA, RB 9-96 
macchws. 
macchwso 


macchwso. 


4 238 (750) | XO nmacchws_ | RT, RA, RB 9-134 
nmacchws. 


nmacchwso 
nmacchwso. 
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Table A-2. PPC405 Instructions by Opcode (continued) 


Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 
4 392 Xx mullhwu RT, RA, RB 9-128 
mullhwu. 
4 396 (908) | XO maclhwu RT, RA, RB 9-106 
maclhwu. 
maclhwuo 
maclhwuo. 
4 424 Xx mullhw RT, RA, RB 9-127 
mullhw. 
4 428 (940) | XO maclhw RT, RA, RB 9-103 
maclhw. 
maclhwo 
maclhwo. 
4 430 (942) | XO nmaclhw RT, RA, RB 9-137 
nmaclhw. 
nmaclhwo 
nmaclhwo. 
4 492 (972) | XO maclhws RT, RA, RB 9-104 
maclhws. 
maclhwso 
maclhwso. 
4 460 (1004) | XO maclhwsu RT, RA, RB 9-105 
maclhwsu. 
maclhwsuo 
maclhwsuo. 
4 494 (1006) | XO nmaclhws RT, RA, RB 9-138 
nmaclhws. 
nmaclhwso 
nmaclhwso. 
7 D mulli RT, RA, IM 9-129 
8 D subfic RT, RA, IM 9-179 
10 D cmpli BF, 0, RA, IM 9-37 
Ad D cmpi BF, 0, RA, IM 9-35 
12 D addic RT, RA, IM 9-10 
13 D addic. RT, RA, IM 9-11 
14 D addi RT, RA, IM 9-9 
15 D addis RT, RA, IM 9-12 
16 B be BO, BI, target 9-20 
bca 
bel 
bcla 
17 SC sc 9-151 
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Table A-2. PPC405 Instructions by Opcode (continued) 


Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 
[78 )6|)St*é<“<t;<‘;‘S;é‘;‘ SSC*C‘;})OW.U OCStargett”.COU€2€©)©)©)6 O-19~| 
ba 
bl 
bla 
19 0 XL merf BF, BFA 9-107 
19 16 XL belr BO, BI 9-30 
belrl 
19 33 XL crnor BT, BA, BB 9-43 
19 50 XL rfi 9-145 
19 51 XL rfci 9-144 
19 129 XL crandc BT, BA, BB 9-40 
19 150 XL isync 9-70 
19 193 XL crxor BT, BA, BB 9-46 
19 225 XL crnand BT, BA, BB 9-42 
19 257 XL crand BT, BA, BB 9-39 
19 289 XL creqv BT, BA, BB 9-41 
19 417 XL crorc BT, BA, BB 9-45 
19 449 XL cror BT, BA, BB 9-44 
19 528 XL bectr BO, BI 9-26 
bectrl 
20 M rlwimi RA, RS, SH, MB, ME | 9-146 
rlwimi. 
21 M rlwinm RA, RS, SH, MB, ME | 9-147 
rlwinm. 
23 M rlwnm RA, RS, RB, MB, ME | 9-150 
rlwnm. 
24 D ori RA, RS, IM 9-142 
25 D oris RA, RS, IM 9-143 
26 D xori RA, RS, IM 9-199 
27 D xoris RA, RS, IM 9-200 
28 D andi. RA, RS, IM 9-17 
29 D andis. RA, RS, IM 9-18 
31 0 Xx cmp BF, 0, RA, RB 9-34 
31 4 Xx tw TO, RA, RB 9-190 
31 8 (520) XO subfc RT, RA, RB 9-177 
subfc. 
subfco 
subfco. 


A-36 PPC405 Core User’s Manual 


Table A-2. PPC405 Instructions by Opcode (continued) 


Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 
31 10 (522) XO addc RT, RA, RB 9-7 
addc. 
addco 
addco. 
31 11 XO mulhwu RT, RA, RB 9-126 
mulhwu. 
31 19 Xx mfcr RT 9-109 
31 20 xX lwarx RT, RA, RB 9-89 
31 23 Xx lwzx RT, RA, RB 9-94 
31 24 Xx slw RA, RS, RB 9-169 
slw. 
31 26 xX entlzw RA, RS 9-38 
cntizw. 
31 28 Xx and RA, RS, RB 9-15 
and. 
31 32 Xx cmpl BF, 0, RA, RB 9-36 
31 40 (552) XO subf RT, RA, RB 9-176 
subf. 
subfo 
subfo. 
31 54 Xx dcbst RA, RB 9-51 
31 55 xX lwzux RT, RA, RB 9-93 
31 60 Xx andc RA, RS, RB 9-16 
andc. 
31 75 XO mulhw RT, RA, RB 9-125 
mulhw. 
31 83 x mfmsr RT 9-111 
31 86 Xx dcbf RA, RB 9-49 
31 87 xX Ibzx RT, RA, RB 9-74 
31 104 (616) | XO neg RT, RA 9-132 
neg. 
nego 
nego. 
31 119 Xx Ibzux RT, RA, RB 9-73 
31 124 xX nor RA, RS, RB 9-139 
nor. 

31 131 x wrtee RS 9-196 
31 136 (648) | XO subfe RT, RA, RB 9-178 
subfe. 
subfeo 
subfeo. 
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Table A-2. PPC405 Instructions by Opcode (continued) 


Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 
[31 | 138(650) |XO|adde |RT,RA,RB (9-8 | 
adde. 
addeo 
addeo. 
31 144 XFX micrf FXM, RS 9-116 
31 146 Xx mtmsr RS 9-118 
31 150 Xx stwex. RS, RA, RB 9-171 
31 151 Xx stwx RS, RA, RB 9-175 
31 163 Xx wrteei E 9-197 
31 183 Xx stwux RS, RA, RB 9-174 
31 200 (712) | XO subfze RT, RA, RB 9-181 
subfze. 
subfzeo 
subfzeo. 
31 202 (714) | XO addze RT, RA 9-14 
addze. 
addzeo 
addzeo. 

31 215 Xx stbx RS, RA, RB 9-159 
31 232 (744) | XO subfme RT, RA, RB 9-180 
subfme. 
subfmeo 

subfmeo. 
31 234 (746) | XO addme RT, RA 9-13 
addme. 
addmeo 
addmeo. 
31 235 (747) | XO mullw RT, RA, RB 9-130 
mullw. 
mullwo 
mullwo. 
31 246 Xx dcbtst RA,RB 9-53 
31 247 Xx stbux RS, RA, RB 9-158 
31 262 Xx icbt RA, RB 9-66 
31 266 (778) | XO add RT, RA, RB 9-6 
add. 
addo 
addo. 
31 278 Xx dcbt RA, RB 9-52 
31 279 Xx Ihzx RT, RA, RB 9-83 
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Table A-2. PPC405 Instructions by Opcode (continued) 


Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 
31 284 xX eqv RA, RS, RB 9-62 
eqv. 
31 311 Xx Ihzux RT, RA, RB 9-82 
31 316 Xx xor RA, RS, RB 9-198 
xor. 
31 323 XFX mfdcr RT, DCRN 9-110 
31 339 XFX mfspr RT, SPRN 9-112 
31 343 xX Ihax RT, RA, RB 9-78 
31 370 Xx tlbia 9-183 
31 371 XFX mftb RT, TBRN 9-114 
31 375 Xx Ihaux RT, RA, RB 9-77 
31 407 Xx sthx RS, RA, RB 9-164 
31 412 xX orc RA, RS, RB 9-141 
orc. 
31 439 Xx sthux RS, RA, RB 9-163 
31 444 xX or RA, RS, RB 9-140 
or. 
31 451 XFX mtdcr DCRN, RS 9-117 
31 454 Xx dccci RA, RB 9-56 
31 459 (971) | XO divwu RT, RA, RB 9-60 
divwu. 
divwuo 
divwuo. 
31 467 XFX mispr SPRN, RS 9-119 
31 470 Xx dcbi RA, RB 9-50 
31 476 Xx nand RA, RS, RB 9-131 
nand. 
31 486 x dcread RT, RA, RB 9-57 
31 491 (1003) | XO divw RT, RA, RB 9-59 
divw. 
divwo 
divwo. 
31 512 x merxr BF 9-108 
31 533 Xx Iswx RT, RA, RB 9-87 
31 534 Xx Iwbrx RT, RA, RB 9-79 
31 536 Xx srw RA, RS, RB 9-155 
srw. 
31 566 Xx tlbsync 9-187 
31 597 xX Iswi RT, RA, NB 9-82 
31 598 X sync 9-182 
31 661 Xx stswx RS, RA, RB 9-167 
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Table A-2. PPC405 Instructions by Opcode (continued) 


Primary | Secondary 
Opcode| Opcode Form Mnemonic Operands Page 
31 662 Xx stwbrx RS, RA, RB 9-170 
31 725 Xx stswi RS, RA, NB 9-166 
31 758 Xx dcba RA, RB 9-47 
31 790 xX Ihbrx RT, RA, RB 9-79 
31 792 xX sraw RA, RS, RB 9-153 
sraw. 
31 824 Xx srawi RA, RS, SH 9-154 
srawi. 
31 854 Xx eieio 9-61 
31 914 Xx tlbsx RT, RA, RB 9-186 
tlbsx. 
31 918 Xx sthbrx RS, RA, RB 9-161 
31 922 Xx extsh RA, RS 9-64 
extsh. 
31 946 Xx tlbre RT, RA,WS 9-184 
31 954 x extsb RA, RS 9-63 
extsb. 
31 966 Xx iccci RA, RB 9-67 
31 978 Xx tlbwe RS, RA,WS 9-188 
31 982 Xx icbi RA, RB 9-65 
31 998 Xx icread RA, RB 9-68 
31 1014 xX dcbz RA, RB 9-54 
32 D lwz RT, D(RA) 9-91 
33 D Iwzu RT, D(RA) 9-92 
34 D Ibz RT, D(RA) 9-71 
35 D Ibzu RT, D(RA) 9-72 
36 D stw RS, D(RA) 9-169 
37 D stwu RS, D(RA) 9-173 
38 D stb RS, D(RA) 9-156 
39 D stbu RS, D(RA) 9-157 
40 D Ihz RT, D(RA) 9-80 
41 D Ihzu RT, D(RA) 9-81 
42 D lha RT, D(RA) 9-75 
43 D Ihau RT, D(RA) 9-76 
44 D sth RS, D(RA) 9-160 
45 D sthu RS, D(RA) 9-162 
46 D Imw RT, D(RA) 9-84 
47 D stmw RS, D(RA) 9-165 
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A.3 Instruction Formats 


Instructions are four bytes long. Instruction addresses are always word-aligned. 


Instruction bits 0 through 5 always contain the primary opcode. Many instructions have an extended 
opcode in another field. Remaining instruction bits contain additional fields. All instruction fields 
belong to one of the following categories: 


* Defined 


These instructions contain values, such as opcodes, that cannot be altered. The instruction format 
diagrams specify the values of defined fields. 


¢ Variable 


These fields contain operands, such as GPR selectors and immediate values, that can vary from 
execution to execution. The instruction format diagrams specify the operands in the variable fields. 


« Reserved 


Bits in reserved fields should be set to 0. In the instruction format diagrams, /, //, or /// indicate 
reserved fields. 


If any bit in a defined field does not contain the expected value, the instruction is illegal and an illegal 
instruction exception occurs. If any bit in a reserved field does not contain 0, the instruction form is 
invalid; its result is architecturally undefined. The PPC405 core executes all invalid instruction forms 
without causing an illegal instruction exception. 


A.3.1. Instruction Fields 


PPC405 instructions contain various combinations of the following fields, as indicated in the 
instruction format diagrams that follow the field definitions. Numbers, enclosed in parentheses, that 
follow the field names indicate bit positions; bit fields are indicated by starting and stopping bit 
positions separated by colons. 


AA (80) Absolute address bit. 


0 The immediate field represents an address relative to the current instruction 
address (CIA). The effective address (EA) of the branch is either the sum of the LI 
field sign-extended to 32 bits and the branch instruction address, or the sum of the 
BD field sign-extended to 32 bits and the branch instruction address. 


1 The immediate field represents an absolute address. The EA of the branch is 
either the LI field or the BD field, sign-extended to 32 bits. 


BA (11:15) Specifies a bit in the CR used as a source of a CR-logical instruction. 
BB (16:20) Specifies a bit in the CR used as a source of a CR-logical instruction. 


BD (16:29) An immediate field specifying a 14-bit signed twos complement branch displacement. 
This field is concatenated on the right with Ob00 and sign-extended to 32 bits. 


BF (6:8) Specifies a field in the CR used as a target in a compare or merf instruction. 
BFA (11:13) | Specifies a field in the CR used as a source in a merf instruction. 


BI (11:15) Specifies a bit in the CR used as a source for the condition of a conditional branch 
instruction. 
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BO (6:10) 


BT (6:10) 
D (16:31) 


DCRN (11:20) 
FXM (12:19) 
IM (16:31) 

LI (6:29) 


LK (31) 


MB (21:25) 


ME (26:30) 


NB (16:20) 
OPCD (0:5) 


OE (21) 


RA (11:15) 
RB (16:20) 
Re (31) 


RS (6:10) 
RT (6:10) 

SH (16:20) 
SPRF (11:20) 
TO (6:10) 

XO (21:30) 


Specifies options for conditional branch instructions. See “BO Field on Conditional 
Branches” on page 2-25. 


Specifies a bit in the CR used as a target as the result of a CR-Logical instruction. 


Specifies a 16-bit signed twos-complement integer displacement for load/store 
instructions. 


Specifies a device control register (DCR). 
Field mask used to identify CR fields to be updated by the mterf instruction. 
An immediate field used to specify a 16-bit value (either signed integer or unsigned). 


An immediate field specifying a 24-bit signed twos complement branch displacement; 
this field is concatenated on the right with b'00' and sign-extended to 32 bits. 


Link bit. 


0 Do not update the link register (LR). 
1 Update the LR with the address of the next instruction. 


Mask begin. 

Used in rotate-and-mask instructions to specify the beginning bit of a mask. 
Mask end. 

Used in rotate-and-mask instructions to specify the ending bit of a mask. 
Specifies the number of bytes to move in an immediate string load or store. 


Primary opcode. Primary opcodes, in decimal, appear in the instruction format 
diagrams presented with individual instructions. The OPCD field name does not 
appear in instruction descriptions. 


Enables setting the OV and SO fields in the fixed-point exception register (XER) for 
extended arithmetic. 


A GPR used as a source or target. 
A GPR used as a source. 
Record bit. 


0 Do not set the CR. 
1 Set the CR to reflect the result of an operation. 


See “Condition Register (CR)” on page 2-10 for a further discussion of how the CR 
bits are set. 


A GPR used as a source. 

A GPR used as a target. 

Specifies a shift amount. 

Specifies a special purpose register (SPR). 

Specifies the conditions on which to trap, as described under tw and twi instructions. 


Extended opcode for instructions without an OE field. Extended opcodes, in decimal, 
appear in the instruction format diagrams presented with individual instructions. The 
XO field name does not appear in instruction descriptions. 
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XO (22:30) Extended opcode for instructions with an OE field. Extended opcodes, in decimal, 
appear in the instruction format diagrams presented with individual instructions. The 
XO field name does not appear in instruction descriptions. 


A.3.2 Instruction Format Diagrams 


The instruction formats (also called “forms”) illustrated in Figure A-1 through Figure A-9 are valid 
combinations of instruction fields. Table A-2 on page A-33 indicates which “form” is utilized by each 
PPC405 opcode. Fields indicated by slashes (/, //, or ///) are reserved. The figures are adapted from 
the PowerPC User Instruction Set Architecture. 
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A.3.2.1. I-Form 


OPCD 


Ll 


A.3.2.2  B-Form 


Figure A-1. | Instruction Format 


31 


OPCD BO BI BD AA|LK 
0) 6 11 16 30 31 
Figure A-2. B Instruction Format 
A.3.2.3  SC-Form 
OPCD My I M 1// 
) 6 11 16 30 31 
Figure A-3. SC Instruction Format 
A.3.2.4 D-Form 
OPCD RT RA D 
OPCD RS RA sl 
OPCD RS RA D 
OPCD RS RA Ul 
OPCD BF RA sl 
OPCD BF RA Ul 
OPCD TO RA sl 
0) 6 11 16 31 


Figure A-4. D Instruction Format 
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A.3.2.5 X-Form 


OPCD RT RA RB xO Re 
OPCD RT RA RB xO / 
OPCD RT RA NB xO / 
OPCD RT RA ws xO / 
OPCD RT 7] RB xO / 
OPCD RT if if xO / 
OPCD RS RA RB xO Re 
OPCD RS RA RB xO 1 
OPCD RS RA RB xO / 
OPCD RS RA NB xO / 
OPCD RS RA ws xO / 
OPCD RS RA SH d<) Rc 
OPCD RS RA Ml xO Re 
OPCD RS If RB xO / 
OPCD RS il Ml xO / 
OPCD BF L RA RB xO / 
OPCD BF I BFA i Ml xO Re 
OPCD BF I il Ml xO / 
OPCD BF I Ml U XO Re 
OPCD BF I Ml if xO / 
OPCD TO RA RB xO / 
OPCD BT If if xO Re 
OPCD My RA RB xO / 
OPCD My Ml If xO / 
OPCD My il E I xO / 

0) 6 11 16 21 31 

Figure A-5. X Instruction Format 

A.3.2.6 XL-Form 
OPCD BT BA BB xO / 
OPCD BC BI My xO LK 
OPCD BF I BFA i if xO / 
OPCD My Ml Mi xO / 

0) 6 11 16 21 31 


Figure A-6. XL Instruction Format 
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A.3.2.7 XFX-Form 


OPCD RT SPRF xO / 
OPCD RT DCRF XO / 
OPCD RT / FXM XO / 
OPCD RS SPRF XO / 
OPCD RS DCRF XO / 
0 6 11 16 21 31 
Figure A-7. XFX Instruction Format 
A.3.2.8 X0-Form 
OPCD RT RA RB OE »<e) Re 
OPCD RT RA RB OE xO Re 
OPCD RT RA Ml / xO Re 
0 6 11 16 21 22 31 
Figure A-8. XO Instruction Format 
A.3.2.9 M-Form 
OPCD RS RA RB MB ME Re 
OPCD RS RA SH MB ME Re 
0) 6 11 16 21 26 31 
Figure A-9. M Instruction Format 
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Appendix B. Instructions by Category 


Chapter 9, “Instruction Set,” contains detailed descriptions of the instructions, their operands, and 


notation. 


Table B-1 summarizes the instruction categories in the PPC405 instruction set. The instructions 
within each category are listed in subsequent tables. 


Storage Reference 


Table B-1. PPC405 Instruction Set Categories 
load, store 


Arithmetic and Logical 


add, subtract, negate, multiply, divide, and, andc, or, orc, xor, nand, nor, xnor, sign 
extension, count leading zeros, multiply accumulate 


Comparison compare, compare logical, compare immediate 

Branch branch, branch conditional, branch to LR, branch to CTR 

CR Logical crand, crandc, cror, crorc, crnand, crnor, crxor, crxnor, move CR field 
Rotate/Shift rotate and insert, rotate and mask, shift left, shift right 


Cache Control 


invalidate, touch, zero, flush, store, read 


Interrupt Control 


Processor Management 


write to external interrupt enable bit, move to/from MSR, return from interrupt, 
return from critical interrupt 

system call, synchronize, trap, move to/from DCRs, move to/from SPRs, move 
to/from CR 


B.1. Implementation-Specific Instructions 


To meet the functional requirements of processors for embedded systems and real-time applications, 
the PPC405 core defines the implementation-specific instructions summarized in Table B-2. 


Table B-2. Implementation-specific Instructions 


Other Registers 


Mnemonic Operands Function Changed Page 


dccci RA, RB 


Invalidate the data cache congruence class 9-56 
associated with the effective address (EA) 
(RAO) + (RB). 


dcread RT, RA, RB Read either tag or data information from the data 9-57 
cache congruence class associated with the EA 
(RAO) + (RB). 
Place the results in RT. 
iccci RA, RB Invalidate instruction cache. 9-67 
icread RA, RB Read either tag or data information from the 9-67 


instruction cache congruence class associated with 
the EA (RA|0) + (RB). 
Place the results in ICDBDR. 
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Table B-2. Implementation-specific Instructions (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
macchw RT, RA, RB prodg:31 — (RA)16:31 Xx (RB)o-15 signed 9-95 
tempo.32 < prodo.31 + (RT) 
macchw. (RT) < temp;.39 CR[CRO] 
macchwo XER[SO, OV] 
macchwo. CR[CRO] 
XER[SO, OV] 
macchws RT, RA, RB | prodg-31 < (RA)16:31 X (RB)o-15 signed 9-96 
tempo.32 < prodg.31 + (RT) 
macchws. if ((prodg = RTo) A (RTo # temp,)) then CRICRO] 
macchwso (RT) < (RT || °'(RT )) XER[SO, OV] 
else (RT) <— tempy.30 
macchwso. ; CR[CRO] 
XER[SO, OV] 
macchwsu RT, RA, RB | prodg-31 < (RA)16:31 X (RB)o.145 unsigned 9-97 
tempo:32 < prodo.31 + (RT) 
macchwsu. (RT) < (tempy.go V 22tempo) CR[CRO] 
macchwsuo XER[SO, OV] 
macchwsuo. CR[CRO] 
XER[SO, OV] 
macchwu RT, RA, RB | prodg-31 < (RA)16:31 X (RB)o.145 unsigned 9-98 
tempo.32 < prodo.31 + (RT) 
macchwu. (RT) < temp,-99 CR[CRO] 
macchwuo XER[SO, OV] 
macchwuo. CR[CRO] 
XER[SO, OV] 
machhw RT, RA, RB prodo-15 << (RA) 16:31 X (RB)9-45 signed 9-99 
tempo:32 < prodo.31 + (RT) 
machhw. (RT) <— temp,.39 CR[CRO] 
machhwo XER[SO, OV] 
machhwo. CR[CRO] 
XER[SO, OV] 
machhws RT, RA, RB | prodg-31 < (RA)g-15 X (RB)o-15 signed 9-100 
tempo.32 < prodg.31 + (RT) 
machhws. if ((prodg = RTo) A (RTo # temp,)) then CRICRO] 
machhwso (RT) < (RTo || °'(ART )) XER[SO, OV] 
else (RT) < tempy.30 
machhwso. : CR[CRO] 
XER[SO, OV] 
machhwsu_ | RT,RA, RB | prodg-31 < (RA)o-15 X (RB)g-45 unsigned 9-101 
tempo:32 < prodo.31 + (RT) 
machhwsu. (RT) < (tempy.g9 V 32} empo) CR[CRO] 
machhwsuo XER[SO, OV] 
machhwsuo. CR[CRO] 
XER[SO, OV] 
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Table B-2. Implementation-specific Instructions (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
machhwu RT, RA, RB prodg-31 <— (RA)g-15 X (RB)g-15 unsigned 9-102 
tempo.32 < prodg.31 + (RT) 
machhwu. (RT) < temp;.39 CR[CRO] 
machhwuo XER[SO, OV] 
machhwuo. CR[CRO] 
XER[SO, OV] 
maclhw RT, RA, RB prodo-34 <- (RA) 16:31 X (RB) 16-31 signed 9-103 
tempo.32 < prodg.31 + (RT) 
maclhw. (RT) <— temp,.39 CR[CRO] 
maclhwo XER[SO, OV] 
maclhwo. CR[CRO] 
XER[SO, OV] 
maclhws RT, RA, RB prodo-34 - (RA) 16:31 xX (RB) 16:31 signed 9-104 
tempo:32 < prodg.31 + (RT) 
maclhws. if ((prodg = RTo) A (RTo # temp;)) then CRICRO] 
maclhwso (RT) < (RT || °'(4RT )) XER[SO, OV] 
else (RT) <— tempy.30 
maclhwso. ; CR[CRO] 
XER[SO, OV] 
maclhwsu RT, RA, RB | prodg-31 < (RA)16:31 X (RB)16-31 unsigned 9-105 
tempo:32 < prodg.31 + (RT) 
maclhwsu. (RT) < (tempy.go V 22tempo) CR[CRO] 
maclhwsuo XER[SO, OV] 
maclhwsuo. CR[CRO] 
XER[SO, OV] 
maclhwu RT, RA, RB | prodg-31 < (RA)16:31 X (RB) 16-31 unsigned 9-106 
tempo:32 < prodo.31 + (RT) 
maclhwu. (RT) < temp,.39 CR[CRO] 
maclhwuo XER[SO, OV] 
maclhwuo. CR[CRO] 
XER[SO, OV] 
mulchw RT, RA, RB (RT)9:31 < (RA)16-31 X (RB)o-15 signed 9-121 
mulchw. CR[CRO] 
mulchwu RT, RA, RB (RT)9:31 < (RA)16-31 X (RB)o-15 unsigned 9-122 
mulchwu. CR[CRO] 
mulhhw RT, RA, RB (RT)9:31 < (RA)g-45 X (RB)o-15 signed 9-123 
mulhhw. CR[CRO] 
mulhhwu RT, RA, RB (RT)9:314 < (RA)g-45 X (RB)o-15 unsigned 9-124 
mulhhwu. CR[CRO] 
mullhw RT, RA, RB (RT)o-31 << (RA)16:31 xX (RB) 16-31 signed 9-127 
mullhw. CR[CRO] 
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Table B-2. Implementation-specific Instructions (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
mullhwu RT, RA, RB | (RT) 16:31 < (RA)o:15 x (RB) 16:31 unsigned 9-128 
mullhwu. CR[CRO] 
nmacchw RT, RA, RB nprodo-31 < —((RA) 16-31 X (RB)g:15) signed 9-133 

tempo.32 < nprodg.3; + (RT) 
nmacchw. (RT) < temp;.39 CR[CRO] 
nmacchwo XER[SO, OV] 
nmacchwo. CR[CRO] 
XER[SO, OV] 
nmacchws_ | RT, RA, RB nprody-31 < —((RA) 16-31 X (RB)g-15) signed 9-134 
tempo.32 <— nprodg.3; + (RT) 
nmacchws. if ((nprody = RTg) A (RTp # temp,)) then CRICRO] 
nmacchwso (RT) <— (RT9|| °'(4RTo)) XER[SO, OV] 
else (RT) < tempy.30 
nmacchwso. CR[CRO] 
XER[SO, OV] 
nmachhw RT, RA, RB | nprodo-31 <— —((RA)g-45 X (RB)o-15) signed 9-135 
tempo.32 < nprodg.3; + (RT) 
nmachhw. (RT) < temp,.39 CR[CRO] 
nmachhwo XER[SO, OV] 
nmachhwo. CR[CRO] 
XER[SO, OV] 
nmachhws_ | RT, RA, RB | nprodg.31 <— —((RA)9-15 X (RB)g-15) signed 9-136 
tempo.32 < nprodg.3; + (RT) 
nmachhws. if ((nprody = RTg) A (RTp # temp,)) then CRICRO] 
nmachhwso (RT) < (RTo || 2'(4RTo)) XER[SO, OV] 
else (RT) < tempy.30 
nmachhwso. CR[CRO] 
XER[SO, OV] 
nmaclhw RT, RA, RB nprody-31 << —((RA) 16-31 X (RB) 46-31) signed 9-137 
tempo.32 < nprodg.3; + (RT) 
nmaclhw. (RT) < temp,.39 CR[CRO] 
nmaclhwo XER[SO, OV] 
nmaclhwo. CR[CRO] 
XER[SO, OV] 
nmaclhws RT, RA, RB nprodg-31 - —((RA) 16-31 X (RB) 46-31) signed 9-138 
teMpo-32 << nprodo.31 + (RT 
piece if ((nprodg = RTg) A (RTp # temp,)) then CAICRO] 
nmaclhwso (RT) < (RT || 2'(4RTo)) XER[SO, OV] 
else (RT) < tempy.30 
nmaclhwso. CR[CRO] 
XER[SO, OV] 
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B.2_ Instructions in the IBM PowerPC Embedded Environment 


To meet the functional requirements of processors for embedded systems and real-time applications, 
the IBM PowerPC Embedded Environment defines instructions that are not part of the PowerPC 
Architecture. 


Table B-3 summarizes the PPC405 core instructions in the PowerPC Embedded Environment. 


Table B-3. Instructions in the IBM PowerPC Embedded Environment 


Other Registers 


Mnemonic) Operands Function Changed Page 

dcba RA, RB Speculatively establish the data cache block which 9-47 
contains the EA (RA|0) + (RB). 

dcbf RA, RB Flush (store, then invalidate) the data cache block 9-49 
which contains the EA (RA|0) + (RB). 

dcbi RA, RB Invalidate the data cache block which contains the EA 9-50 
(RA|O) + (RB). 

dcbst RA, RB Store the data cache block which contains the EA 9-50 
(RA|O) + (RB). 

dcbt RA, RB Load the data cache block which contains the EA 9-52 
(RA|O) + (RB). 

dcbtst RA,RB Load the data cache block which contains the EA 9-53 
(RA|O) + (RB). 

dcbz RA, RB Zero the data cache block which contains the EA 9-54 
(RA|O) + (RB). 

eieio Storage synchronization. All loads and stores that 9-61 
precede the eieio instruction complete before any 
loads and stores that follow the instruction access 
main storage. 
Implemented as sync, which is more restrictive. 

icbi RA, RB Invalidate the instruction cache block which contains 9-65 
the EA (RA|O) + (RB). 

icbt RA, RB Load the instruction cache block which contains the 9-66 
EA (RA|O) + (RB). 

isync Synchronize execution context by flushing the 9-70 
prefetch queue. 

mfdcr RT, DCRN Move from DCR to RT, 9-110 
(RT) < (DCR(DCRN)). 

mfmsr RT Move from MSR to RT, 9-111 
(RT) < (MSR). 

mfspr RT, SPRN Move from SPR to RT, 9-112 
(RT) < (SPR(SPRN)). 
Privileged for all SPRs except 
LR, CTR, TBHU, TBLU, and XER. 
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Table B-3. Instructions in the IBM PowerPC Embedded Environment (continued) 


Mnemonic 


mftb 


Operands 


RT 


Function 


Move the contents of a Time Base Register (TBR) 
into RT, 

TBRN <— TBRFs.9 || TBRFo.4 

(RT) <— (TBR(TBRN)) 


Other Registers 
Changed 


Page 
9-114 


midcr 


DCRN, RS 


Move to DCR from RS, 
(DCR(DCRN)) < (RS). 


9-117 


mtmsr 


RS 


Move to MSR from RS, 
(MSR) < (RS). 


9-118 


mtspr 


SPRN, RS 


Move to SPR from RS, 
(SPR(SPRN)) < (RS). 
Privileged for all SPRs except 
LR, CTR, and XER. 


9-119 


rfci 


Return from critical interrupt 
(PC) < (SRR2). 
(MSR) < (SRR9). 


9-144 


rfi 


Return from interrupt. 
(PC) < (SRRO). 
(MSR) < (SRRY1). 


9-145 


tlbia 


All of the entries in the TLB are invalidated and 
become unavailable for translation by clearing the 
valid (V) bit in the TLBHI portion of each TLB entry. 
The rest of the fields in the TLB entries are 
unmodified. 


9-183 


tlbre 


RT, RA,WS 


If WS = 0: 

Load TLBHI portion of the selected TLB entry into RT. 
Load the PID register with the contents of the TID 
field of the selected TLB entry. 

(RT) <— TLBHI[(RA)] 

(PID) <— TLB[(RA)]rip 


lf WS = 1: 

Load TLBLO portion of the selected TLB entry into 
RT. 

(RT) < TLBLO[(RA)] 


9-184 
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Table B-3. Instructions in the IBM PowerPC Embedded Environment (continued) 


Other Registers 
Mnemonic | Operands Function Changed Page 
tlbsx RT,RA,RB Search the TLB array for a valid entry which 9-186 
translates the EA 
EA = (RA|O) + (RB). 
If found, 
(RT) < Index of TLB entry. 
If not found, 
(RT) Undefined. 
tlbsx. If found, CR[CRO]it.6t.so 
(RT) < Index of TLB entry. 
If not found, 
(RT) Undefined. 
tlbsync tlbsync does not complete until all previous TLB- 9-187 
update instructions executed by this processor have 
been received and completed by all other processors. 
For the PPC405 core, tlbsync is a no-op. 
tlbwe RS, RA,WS | If WS =0: 9-188 
Write TLBHI portion of the selected TLB entry from 
RS. 
Write the TID field of the selected TLB entry from the 
PID register. 
TLBHI[(RA)] < (RS) 
TLB[(RA)Irip <— (PID) 24-31 
lf WS = 1: 
Write TLBLO portion of the selected TLB entry from 
RS. 
TLBLO[(RA)] < (RS) 
wrtee RS Write value of RS, to MSRI[EE]. 9-196 
wrteei E Write value of E to MSR[EE]. 9-197 


B.3 Privileged Instructions 


Table B-4 lists instructions that are under control of the MSR[PR] bit. These instructions are not 
allowed to be executed when MSR[PR] = 1: 


Table B-4. Privileged Instructions 


Other Registers 
Mnemonic | Operands Function Changed Page 
debi RA, RB Invalidate the data cache block which contains the EA 9-50 
(RA|O) + (RB). 
dccci RA, RB Invalidate the data cache congruence class associated 9-56 
with the EA (RA|0) + (RB). 
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Table B-4. Privileged Instructions (continued) 


Mnemonic 


dcread 


Operands 


RT, RA, 
RB 


Function 


Read either tag or data information from the data cache 
congruence class associated with the EA (RA|0O) + (RB). 
Place the results in RT. 


Other Registers 
Changed 


Page 
9-57 


iccci 


RA, RB 


Invalidate instruction cache. 


9-67 


icread 


RA, RB 


Read either tag or data information from the instruction 
cache congruence class associated with the EA 
(RA|O) + (RB). 

Place the results in ICDBDR. 


9-68 


mfdcr 


RT, DCRN 


Move from DCR to RT, 
(RT) — (DCR(DCRN)). 


9-110 


mfmsr 


RT 


Move from MSR to RT, 
(RT) <— (MSR). 


9-111 


mfspr 


RT, SPRN 


Move from SPR to RT, 

(RT) <— (SPR(SPRN)). 
Privileged for all SPRs except 

LR, CTR, TBHU, TBLU, and XER. 


9-112 


midcr 


DCRN, RS 


Move to DCR from RS, 
(DCR(DCRN)) < (RS). 


9-117 


mtmsr 


RS 


Move to MSR from RS, 
(MSR) < (RS). 


9-118 


mtspr 


SPRN, RS 


Move to SPR from RS, 
(SPR(SPRN)) < (RS). 
Privileged for all SPRs except 
LR, CTR, and XER. 


9-119 


rfci 


Return from critical interrupt 
(PC) < (SRR2). 
(MSR) < (SRR9). 


9-144 


rfi 


Return from interrupt. 
(PC) < (SRRO). 
(MSR) < (SRRY1). 


9-145 


tlbre 


RT, 
RA,WS 


If WS = 0: 

Load TLBHI portion of the selected TLB entry into RT. 
Load the PID register with the contents of the TID field of 
the selected TLB entry. 

(RT) < TLBHI[(RA)] 

(PID) <— TLB[(RA)Irip 


If WS = 1: 
Load TLBLO portion of the selected TLB entry into RT. 
(RT) < TLBLO[(RA)] 
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Table B-4. Privileged Instructions (continued) 


Other Registers 
Mnemonic | Operands Function Changed Page 


tlbsx RT,RA,RB | Search the TLB array for a valid entry which translates 9-186 
the EA 
EA = (RA|O) + (RB). 
If found, 
(RT) < Index of TLB entry. 
If not found, 
(RT) Undefined. 


tlbsx. If found, CR[CRO]it.et.so 
(RT) < Index of TLB entry. 
If not found, 
(RT) Undefined. 


tlbwe RS, If WS = 0: 9-188 
RA,WS Write TLBHI portion of the selected TLB entry from RS. 
Write the TID field of the selected TLB entry from the 
PID register. 

TLBHI[(RA)] <— (RS) 

TLB[(RA)]tip <— (PID)24:31 


If WS = 1: 
Write TLBLO portion of the selected TLB entry from RS. 
TLBLO[(RA)] < (RS) 


wrtee RS Write value of RS1¢ to the External Enable 9-196 
bit (MSR[EE}). 


wrteei E Write value of E to the External Enable 9-197 
bit (MSR[EE)). 


B.4 Assembler Extended Mnemonics 


In the appendix “Assembler Extended Mnemonics” of the PowerPC Architecture, it is required that a 
PowerPC assembler support at least a minimal set of extended mnemonics. These mnemonics 
encode to the opcodes of other instructions; the only benefit of extended mnemonics is improved 
usability. Code using extended mnemonics can be easier to write and to understand. Table B-5 lists 
the extended mnemonics required for the PPC405. 


Note for every Branch Conditional mnemonic: 


Bit 4 of the BO field provides a hint about the most likely outcome of a conditional branch. (“Branch 
Prediction” on page 2-26 describes branch prediction). Assemblers should set BO, = 0 unless a 
specific reason exists otherwise. In the BO field values specified in the following table, BO, = 0 has 
always been assumed. The assembler must allow the programmer to specify branch prediction. To do 
this, the assembler will support a suffix to every conditional branch mnemonic, as follows: 


+ Predict branch to be taken. 


— Predict branch not to be taken. 
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As specific examples, be also could be coded as bce+ or bc-, and bne also could be coded bne+ or 
bne-. These alternate codings set BO, = 1 only if the requested prediction differs from the standard 
prediction (see “Branch Prediction” on page 2-26). 


Table B-5. Extended Mnemonics for PPC405 


Other Registers 


Mnemonic | Operands Function Changed Page 
betr Branch unconditionally to address in CTR. 9-26 
Extended mnemonic for 
bectr 20,0 
betrl Extended mnemonic for (LR) — CIA + 4 
bectrl 20,0 
bdnz target Decrement CTR. 9-20 
Branch if CTR #0. 
Extended mnemonic for 
be 16,0,target 
bdnza Extended mnemonic for 
bea 16,0,target 
bdnzl Extended mnemonic for (LR) < CIA + 4. 
bel 16,0,target 
bdnzla Extended mnemonic for (LR) < CIA + 4. 
bcla 16,0,target 
bdnzlr Decrement CTR. 9-30 
Branch, if CTR # 0,to address in LR. 
Extended mnemonic for 
belr 16,0 
bdnzlrl Extended mnemonic for (LR) < CIA + 4. 
belrl 16,0 
bdnzf cr_bit, target | Decrement CTR. 9-20 
Branch if CTR #0 AND CR, pit = 0. 
Extended mnemonic for — 
be 0,cr_bit,target 
bdnzfa Extended mnemonic for 
bea 0,cr_bit,target 
bdnzfl Extended mnemonic for (LR) < CIA + 4. 
bel 0,cr_bit,target 
bdnzfla Extended mnemonic for (LR) < CIA + 4. 
bcla 0,cr_bit,target 
bdnzflr cr_bit Decrement CTR. 9-30 
Branch, if CTR #0 AND CRe, pit = 0, to address in LR. 
Extended mnemonic for 
belr 0,cr_bit 
bdnzfirl Extended mnemonic for (LR) < CIA + 4. 
belrl 0,cr_bit 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bdnzt 


bdnzta 


bdnztl 


bdnzila 


Operands 


cr_bit, target 


Function 


Decrement CTR. 

Branch if CTR #0 AND CR,» pit = 1. 
Extended mnemonic for 
be 8,cr_bit,target 


Other Registers 
Changed 


Extended mnemonic for 
bea 8,cr_bit,target 


Extended mnemonic for 
bel 8,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 8,cr_bit,target 


(LR) — CIA +4. 


Page 
9-20 


bdnztlr 


bdnztirl 


cr_bit 


Decrement CTR. 

Branch, if CTR #0 AND CR, pit = 1, to address in LR. 
Extended mnemonic for 
belr 8,cr_bit 


Extended mnemonic for 
belrl 8,cr_bit 


(LR) — CIA +4. 


9-30 


bdz 


bdza 


bdzl 


bdzla 


target 


Decrement CTR. 

Branch if CTR = 0. 
Extended mnemonic for 
be 18,0,target 


Extended mnemonic for 
bea 18,0,target 


Extended mnemonic for 
bel 18,0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 18,0,target 


(LR) — CIA +4. 


9-20 


bdzir 


bdzirl 


Decrement CTR. 

Branch, if CTR = 0, to address in LR. 
Extended mnemonic for 
belr 18,0 


Extended mnemonic for 
belrl 18,0 


(LR) — CIA +4. 


9-30 


bdzf 


bdzfa 


bdzfl 


bdzfla 


cr_bit, target 


Decrement CTR. 

Branch if CTR = 0 AND CRe, pit = 0. 
Extended mnemonic for 
be 2,cr_bit,target 


Extended mnemonic for 
bea 2,cr_bit,target 


Extended mnemonic for 
bel 2,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 2,cr_bit,target 


(LR) — CIA +4. 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bdzfir 


Operands 


cr_bit 


bdzfirl 


Function 


Decrement CTR. 

Branch, if CTR = 0 AND CR, pit = 0 to address in LR. 
Extended mnemonic for 
belr 2,cr_bit 


Other Registers 
Changed 


Extended mnemonic for 
belrl 2,cr_bit 


(LR) — CIA +4. 


Page 
9-30 


bdzt 


cr_bit, target 


bdzta 


bdztl 


bdztla 


Decrement CTR. 

Branch if CTR = 0 AND CR, pit = 1. 
Extended mnemonic for 
be 10,cr_bit,target 


Extended mnemonic for 
bea 10,cr_bit,target 


Extended mnemonic for 
bel 10,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 10,cr_bit,target 


(LR) — CIA +4. 


9-20 


bdztir 


cr_bit 


bdztirl 


Decrement CTR. 

Branch, if CTR = 0 AND CR, pit = 1, to address in LR. 
Extended mnemonic for 
belr 10,cr_bit 


Extended mnemonic for 
belrl 10,cr_bit 


(LR) — CIA +4. 


9-30 


beq 


[cr_field,] 
target 


beqa 


beql 


beqla 


Branch if equal. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+2,target 


Extended mnemonic for 
bea 12,4«cr_field+2,target 


Extended mnemonic for 
bel 12,4«cr_field+2,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+2,target 


(LR) — CIA +4. 


9-20 


beqctr 


[cr_field] 


begqctrl 


Branch, if equal, to address in CTR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+2 


Extended mnemonic for 
bectrl 12,4«cr_field+2 


(LR) — CIA +4. 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


beqIr 


bedIrl 


Operands 


[cr_field] 


Function 


Branch, if equal, to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4*cr_field+2 


Other Registers 
Changed 


Extended mnemonic for 
belrl 12,4*cr_field+2 


(LR) — CIA +4. 


Page 
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bf 


bfa 


bfl 


bfla 


cr_bit, target 


Branch if CRer pit = 0. 
Extended mnemonic for 
be 4,cr_bit,target 


Extended mnemonic for 
bea 4,cr_bit,target 


Extended mnemonic for 
bel 4,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,cr_bit,target 


(LR) — CIA +4. 


9-20 


bfctr 


bfctrl 


cr_bit 


Branch, if CRe, pit = 0, to address in CTR. 
Extended mnemonic for 
bectr 4,cr_bit 


Extended mnemonic for 
bectrl 4,cr_bit 


(LR) — CIA +4. 


9-26 


bfir 


bfirl 


cr_bit 


Branch, if CRe, pit = 0, to address in LR. 
Extended mnemonic for 
belr 4,cr_bit 


Extended mnemonic for 
belrl 4,cr_bit 


(LR) — CIA +4. 


9-30 


bge 


bgea 


bgel 


bgela 


[cr_field,] 
target 


Branch if greater than or equal. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+0,target 


Extended mnemonic for 
bea 4,4«cr_field+0,target 


Extended mnemonic for 
bel 4,4«cr_field+0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+0,target 


(LR) — CIA +4. 


9-20 


bgectr 


bgectrl 


[cr_field] 


Branch, if greater than or equal, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4«cr_field+0 


Extended mnemonic for 
bectrl 4,4«cr_field+0 


(LR) — CIA +4. 


9-26 


Instructions by Category 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bgelr 


Operands 


[cr_field] 


bgelrl 


Function 


Branch, if greater than or equal, to address in LR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+0 


Other Registers 
Changed 


Extended mnemonic for 
belrl 4,4«cr_field+0 


(LR) — CIA +4. 


Page 
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bgt 


[cr_field,] 
target 


bgta 


bgtl 


bgtla 


Branch if greater than. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+1,target 


Extended mnemonic for 
bea 12,4«cr_field+1,target 


Extended mnemonic for 
bel 12,4«cr_field+1,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+1,target 


(LR) — CIA +4. 


9-20 


bgtctr 


[cr_field] 


bgtctrl 


Branch, if greater than, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+1 


Extended mnemonic for 
bectrl 12,4«cr_field+1 


(LR) — CIA +4. 


9-26 


bgtir 


[cr_field] 


bgtirl 


Branch, if greater than, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 12,4*cr_field+1 


Extended mnemonic for 
belrl 12,4*cr_field+1 


(LR) — CIA +4. 


9-30 


ble 


[cr_field,] 
target 


blea 


blel 


blela 


Branch if less than or equal. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+1,target 


Extended mnemonic for 
bea 4,4«cr_field+1,target 


Extended mnemonic for 
bel 4,4«cr_field+1,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+1,target 


(LR) — CIA +4. 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


blectr 


blectrl 


Operands 


[cr_field] 


Function 


Branch, if less than or equal, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4«cr_field+1 


Other Registers 
Changed 


Extended mnemonic for 
bectrl 4,4«cr_field+1 


(LR) — CIA +4. 


Page 
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blelr 


blelrl 


[cr_field] 


Branch, if less than or equal, to address in LR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4*cr_field+1 


Extended mnemonic for 
belrl 4,4«cr_field+1 


(LR) — CIA +4. 


9-30 


bir 


birl 


Branch, unconditionally, to address in LR. 


Extended mnemonic for 
belr 20,0 


Extended mnemonic for 
belrl 20,0 


(LR) —CIA +4. 


9-30 


bit 


bita 


bitl 


bitla 


[cr_field,] 
target 


Branch if less than. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+0,target 


Extended mnemonic for 
bea 12,4«cr_field+0,target 


Extended mnemonic for 
bel 12,4«cr_field+0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+0,target 


(LR) — CIA +4. 


9-20 


bltctr 


bltctrl 


[cr_field] 


Branch, if less than, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+0 


Extended mnemonic for 
bectrl 12,4*cr_field+0 


(LR) — CIA +4. 


9-26 


bitir 


bitirl 


[cr_field] 


Branch, if less than, to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4*cr_field+0 


Extended mnemonic for 
belrl 12,4«cr_field+0 


(LR) — CIA +4. 


9-30 


Instructions by Category 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bne 


Operands 


[cr_field,] 
target 


bnea 


bnel 


bnela 


Function 


Branch if not equal. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+2,target 


Other Registers 
Changed 


Extended mnemonic for 
bea 4,4«cr_field+2,target 


Extended mnemonic for 
bel 4,4«cr_field+2,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+2,target 


(LR) — CIA +4. 


Page 
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bnectr 


[cr_field] 


bnectrl 


Branch, if not equal, to address in CTR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4«cr_field+2 


Extended mnemonic for 
bectrl 4,4«cr_field+2 


(LR) — CIA +4. 


9-26 


bnelr 


[cr_field] 


bnelrl 


Branch, if not equal, to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+2 


Extended mnemonic for 
belrl 4,4«cr_field+2 


(LR) — CIA +4. 


9-30 


bng 


[cr_field,] 
target 


bnga 


bngl 


bngla 


Branch, if not greater than. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+1,target 


Extended mnemonic for 
bea 4,4«cr_field+1,target 


Extended mnemonic for 
bel 4,4«cr_field+1,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+1,target 


(LR) — CIA +4. 


9-20 


bngctr 


[cr_field] 


bngctrl 


Branch, if not greater than, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4«cr_field+1 


Extended mnemonic for 
bectrl 4,4«cr_field+1 


(LR) — CIA +4. 


9-26 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bnglr 


bnglrl 


Operands 


[cr_field] 


Function 


Branch, if not greater than, to address in LR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 4,4«cr_field+1 


Other Registers 
Changed 


Extended mnemonic for 
belrl 4,4«cr_field+1 


(LR) — CIA +4. 


Page 
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bnl 


bnla 


bnil 


bnila 


[cr_field,] 
target 


Branch if not less than. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+0,target 


Extended mnemonic for 
bea 4,4«cr_field+0,target 


Extended mnemonic for 
bel 4,4«cr_field+0,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+0,target 


(LR) — CIA +4. 


9-20 


bnictr 


bnictrl 


[cr_field] 


Branch, if not less than, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 4,4*cr_field+0 


Extended mnemonic for 
bectrl 4,4«cr_field+0 


(LR) — CIA +4. 


9-26 


bnilr 


bnilrl 


[cr_field] 


Branch, if not less than, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+0 


Extended mnemonic for 
belrl 4,4«cr_field+0 


(LR) —CIA +4. 


9-30 


bns 


bnsa 


bnsl 


bnsla 


[cr_field,] 
target 


Branch if not summary overflow. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+3,target 


Extended mnemonic for 
bea 4,4«cr_field+3,target 


Extended mnemonic for 
bel 4,4«cr_field+3,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+3,target 


(LR) — CIA +4. 


9-20 


Instructions by Category 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bnsctr 


Operands 


[cr_field] 


bnsctrl 


Function 


Branch, if not summary overflow, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+3 


Other Registers 
Changed 


Extended mnemonic for 
bectrl 4,4«cr_field+3 


(LR) — CIA +4. 


Page 
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bnsir 


[cr_field] 


bnsirl 


Branch, if not summary overflow, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+3 


Extended mnemonic for 
belrl 4,4«cr_field+3 


(LR) — CIA +4. 


9-30 


bnu 


[cr_field,] 
target 


bnua 


bnul 


bnula 


Branch if not unordered. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 4,4«cr_field+3,target 


Extended mnemonic for 
bea 4,4«cr_field+3,target 


Extended mnemonic for 
bel 4,4«cr_field+3,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 4,4«cr_field+3,target 


(LR) — CIA +4. 


9-20 


bnuctr 


[cr_field] 


bnuctrl 


Branch, if not unordered, to address in CTR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

bectr 4,4«cr_field+3 


Extended mnemonic for 
bectrl 4,4«cr_field+3 


(LR) — CIA +4. 


9-26 


bnulr 


[cr_field] 


bnulrl 


Branch, if not unordered, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 4,4«cr_field+3 


Extended mnemonic for 
belrl 4,4«cr_field+3 


(LR) — CIA +4. 


9-30 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bso 


bsoa 


bsol 


bsola 


Operands 


[cr_field,] 
target 


Function 


Branch if summary overflow. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+3,target 


Other Registers 
Changed 


Extended mnemonic for 
bea 12,4«cr_field+3,target 


Extended mnemonic for 
bel 12,4«cr_field+3,target 


(LR) —CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+3,target 


(LR) — CIA +4. 


Page 
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bsoctr 


bsoctrl 


[cr_field] 


Branch, if summary overflow, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+3 


Extended mnemonic for 
bectrl 12,4«cr_field+3 


(LR) — CIA +4. 


9-26 


bsolr 


bsolrl 


[cr_field] 


Branch, if summary overflow, to address in LR. 
Use CRO if cr_field is omitted. 

Extended mnemonic for 

belr 12,4*cr_field+3 


Extended mnemonic for 
belrl 12,4«cr_field+3 


(LR) — CIA +4. 


9-30 


bt 


bta 


btl 


btla 


cr_bit, target 


Branch if CRe, pit = 1. 
Extended mnemonic for 
be 12,cr_bit,target 


Extended mnemonic for 
bea 12,cr_bit,target 


Extended mnemonic for 
bel 12,cr_bit,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,cr_bit,target 


(LR) — CIA +4. 


9-20 


btctr 


btctrl 


cr_bit 


Branch if CRe- pit = 1, 

to address in CTR. 
Extended mnemonic for 
bectr 12,cr_bit 


Extended mnemonic for 
bectrl 12,cr_bit 


(LR) — CIA +4. 


9-26 


btlr 


btirl 


cr_bit 


Branch, if CRe, pit = 1, to address in LR. 
Extended mnemonic for 
belr 12,cr_bit 


Extended mnemonic for 
belrl 12,cr_bit 


(LR) — CIA +4. 


9-30 


Instructions by Category 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


bun 


Operands 


[cr_field,] 
target 


buna 


bunl 


bunla 


Function 


Branch if unordered. 

Use CRO if cr_field is omitted. 
Extended mnemonic for 
be 12,4«cr_field+3,target 


Other Registers 
Changed 


Extended mnemonic for 
bea 12,4«cr_field+3,target 


Extended mnemonic for 
bel 12,4«cr_field+3,target 


(LR) — CIA +4. 


Extended mnemonic for 
bela 12,4«cr_field+3,target 


(LR) — CIA +4. 


Page 
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bunctr 


[cr_field] 


bunctrl 


Branch, if unordered, to address in CTR. 


Use CRO if cr_field is omitted. 
Extended mnemonic for 
bectr 12,4«cr_field+3 


Extended mnemonic for 
bectrl 12,4*cr_field+3 


(LR) — CIA +4. 


9-26 


bunir 


[cr_field] 


bunirl 


Branch, if unordered, to address in LR. 
Use CRO if cr_field is omitted. 
Extended mnemonic for 
belr 12,4*cr_field+3 


Extended mnemonic for 
belrl 12,4«cr_field+3 


(LR) — CIA +4. 


9-30 


clrlwi 


RA, RS, n 


clrlwi. 


Clear left immediate. (n < 32) 
(RA)o:n1 << "0 
Extended mnemonic for 
rlwinm RA,RS,0,n,31 


Extended mnemonic for 
rlwinm. RA,RS,0,n,31 


CR[CRO] 


9-147 


clrlslwi 


RA, RS, b, n 


clrlslwi. 


Clear left and shift left immediate. 
(n<b<32) 


Extended mnemonic for 
rlwinm RA,RS,n,b-n,31—n 


Extended mnemonic for 
rlwinm. RA,RS,n,b—n,31—n 


CR[CRO] 


9-147 


clrrwi 


RA, RS, n 


clrrwi. 


Clear right immediate. (n < 32) 
(RA)32-n:31 "0 
Extended mnemonic for 
rlwinm RA,RS,0,0,31—n 


Extended mnemonic for 
rlwinm. RA,RS,0,0,31—n 


CR[CRO] 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


cmplw 


Operands 


[BF] RA, RB 


Function 


Compare Logical Word. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmpl BF,0,RA,RB 


Other Registers 
Changed 


Page 
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cmplwi 


[BF] RA, IM 


Compare Logical Word Immediate. 
Use CRO if BF is omitted. 
Extended mnemonic for 
cmpli BF,0,RA,IM 


9-37 


cmpw 


[BF] RA, RB 


Compare Word. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmp BF,0,RA,RB 


9-34 


cmpwi 


[BF] RA, IM 


Compare Word Immediate. 

Use CRO if BF is omitted. 
Extended mnemonic for 
cmpi BF,0,RA,IM 


9-35 


cerclr 


bx 


Condition register clear. 
Extended mnemonic for 
crxor bx,bx,bx 


9-46 


crmove 


bx, by 


Condition register move. 
Extended mnemonic for 
cror bx,by,by 


9-44 


crnot 


bx, by 


Condition register not. 
Extended mnemonic for 
crnor bx,by,by 


9-43 


crset 


bx 


Condition register set. 
Extended mnemonic for 
creqv bx,bx,bx 


9-44 


extlwi 


extlwi. 


RA, RS, n, b 


Extract and left justify immediate. (n > 0) 
(RA)o:n-1 <— (RS)b-bsn—1 
(RA)n:31 <— 9° "0 

Extended mnemonic for 

rlwinm RA,RS,b,0,n-1 


Extended mnemonic for 
rlwinm. RA,RS,b,0,n-1 


CR[CRO] 


9-147 


extrwi 


extrwi. 


RA, RS, n, b 


Extract and right justify immediate. (n > 0) 
(RA)32-n:31 <— (RS)b-b4n-1 
(RA)o31-n <— °* "0 

Extended mnemonic for 

rlwinm RA,RS,b+n,32-n,31 


Extended mnemonic for 
rlwinm. RA,RS,b+n,32-n,31 


CR[CRO] 


9-147 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


inslwi 


Operands 


RA, RS, n, b 


inslwi. 


Function 


Insert from left immediate. (n > 0) 
(RA)b:bsn-1 — (RS)o:n-1 
Extended mnemonic for 
rlwimi RA,RS,32-b,b,b+n-1 


Other Registers 
Changed 


Extended mnemonic for 
rlwimi. RA,RS,32-b,b,b+n-1 


CR[CRO] 


Page 
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insrwi 


RA, RS, n, b 


insrwi. 


Insert from right immediate. (n > 0) 
(RA)b:b+n—1 — (RS)32-n:31 
Extended mnemonic for 
rlwimi RA,RS,32-b-n,b,b+n-1 


Extended mnemonic for 
rlwimi. RA,RS,32-b-n,b,b+n-1 


CR[CRO] 


9-146 


la 


RT, D(RA) 


Load address. (RA # 0) 
D is an offset from a base address that is assumed to 
be (RA). 
(RT) <— (RA) + EXTS(D) 
Extended mnemonic for 
addi RT,RA,D 


9-9 


RT, IM 


Load immediate. 

(RT) <— EXTS(IM) 
Extended mnemonic for 
addi RT,0,value 


9-9 


lis 


RT, IM 


Load immediate shifted. 

(RT) < (IM || 180) 
Extended mnemonic for 
addis RT,0,value 


9-12 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


mfccr0O 
mfctr 
mfdac1 
mfdac2 
mfdear 
mfdbcr0 
mfdbcr1 
mfdbsr 
mfdccr 
mfdcewr 
mfdvc1 
mfdvc2 
mfesr 
mfevpr 
mfiac1 
mfiac2 
mfiac3 
mfiac4 
mficcr 
mficdbdr 
mfir 
mfpid 
mfpit 
mfpvr 
mfsgr 
mfsler 
mfsprg0O 
mfsprg1 
mfsprg2 
mfsprg3 
mfsprg4 
mfsprg5 
mfsprg6 
mfsprg7 
mfsrr0 
mfsrr1 
mfsrr2 
mfsrr3 
mfsuOr 
mftcr 
mftsr 
mfxer 
mfzpr 


Operands 


RT 


Function 


Move from special purpose register (SPR) SPRN. 
Extended mnemonic for 
mfspr RT,SPRN 


See Table 10.5, “Special Purpose Registers,” on 
page 10-2 for listing of valid SPRN values. 


Other Registers 
Changed 


Page 
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mftb 


RT 


Move the contents of TBL into RT, 
(RT) < (TBL) 

Extended mnemonic for 

mftb RT,TBL 


9-114 


Instructions by Category 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


mftbu 


Operands 


RT 


Function 


Move the contents of TBU into RT, 
(RT) <— (TBU) 

Extended mnemonic for 

mftb RT, TBU 


Other Registers 
Changed 


Page 
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RT, RS 


Move register. 

(RT) < (RS) 
Extended mnemonic for 
or RT,RS,RS 


Extended mnemonic for 
or. RT,RS,RS 


CR[CRO] 


9-140 


mtcr 


RS 


Move to Condition Register. 
Extended mnemonic for 
micrf OxFF,RS 


9-116 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


mtccr0O 
mtctr 
mtdac1 
mtdac2 
mtdbcr0 
mtdbcr1 
mtdbsr 
mtdccr 
mtdear 
mtdewr 
mtdvc1 
mtdvc2 
mtesr 
mtevpr 
mtiac1 
mtiac2 
mtiac3 
mtiac4 
mticcr 
mticdbdr 
miir 
mtpid 
mtpit 
mipvr 
mtsgr 
mtsler 
mtsprgO 
mtsprg1 
mtsprg2 
mtsprg3 
mtsprg4 
mtsprg5 
mtsprg6 
mtsprg7 
mtsrr0 
mtsrr1 
misrr2 
mtsrr3 
mtsuOr 
mttcr 
mttsr 
mtxer 
mizpr 


Operands 


RS 


Function 


Move to SPR SPRN. 
Extended mnemonic for 
mtspr SPRN,RS 


See Table 10.5, “Special Purpose Registers,” on 
page 10-2 for listing of valid SPRN values. 


Other Registers 
Changed 


Page 
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nop 


Preferred no-op; triggers optimizations based on 
no-ops. 

Extended mnemonic for 

ori 0,0,0 


9-142 


Instructions by Category 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


not 


Operands 


RA, RS 


not. 


Function 


Complement register. 

(RA) < —(RS) 
Extended mnemonic for 
nor RA,RS,RS 


Other Registers 
Changed 


Extended mnemonic for 
nor. RA,RS,RS 


CR[CRO] 


Page 
9-139 


rotlw 


RA, RS, RB 


rotlw. 


Rotate left. 

(RA) <— ROTL((RS), (RB)o7-31) 
Extended mnemonic for 
rlwnm RA,RS,RB,0,31 


Extended mnemonic for 
rlwnm. RA,RS,RB,0,31 


CR[CRO] 


9-150 


rotlwi 


RA, RS, n 


rotlwi. 


Rotate left immediate. 

(RA) < ROTL((RS), n) 
Extended mnemonic for 
rlwinm RA,RS,n,0,31 


Extended mnemonic for 
rlwinm. RA,RS,n,0,31 


CR[CRO] 


9-147 


rotrwi 


RA, RS, n 


rotrwi. 


Rotate right immediate. 
(RA) < ROTL((RS), 32-n) 
Extended mnemonic for 
rlwinm RA,RS,32-n,0,31 


Extended mnemonic for 
rlwinm. RA,RS,32-n,0,31 


CR[CRO] 


9-147 


slwi 


RA, RS, n 


slwi. 


Shift left immediate. (n < 32) 
(RA)o:31-n <— (RS)n:31 
(RA)32-n-31 0 
Extended mnemonic for 
rlwinm RA,RS,n,0,31-n 


Extended mnemonic for 
rlwinm. RA,RS,n,0,31—n 


CR[CRO] 


9-147 


srwi 


RA, RS, n 


srwi. 


Shift right immediate. (n < 32) 
(RA)n:31 <— (RS)o:31-n 
(RA)o:n-1 
Extended mnemonic for 
rlwinm RA,RS,32-n,n,31 


Extended mnemonic for 
rlwinm. RA,RS,32-n,n,31 


CR[CRO] 


9-147 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


sub 


sub. 


subo 


subo. 


Operands 


RT, RA, RB 


Function 


Subtract (RB) from (RA). 
(RT) < —(RB) + (RA) + 1. 
Extended mnemonic for 

subf RT,RB,RA 


Other Registers 
Changed 


Extended mnemonic for 
subf. RT,RB,RA 


CR[CRO] 


Extended mnemonic for 
subfo RT,RB,RA 


XER[SO, OV] 


Extended mnemonic for 
subfo. RT,RB,RA 


CR[CRO] 
XER[SO, OV] 


Page 
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subc 


subc. 


subco 


subco. 


RT, RA, RB 


Subtract (RB) from (RA). 

(RT) < —(RB) + (RA) + 1. 

Place carry-out in XER[CA]. 
Extended mnemonic for 
subfc RT,RB,RA 


Extended mnemonic for 
subfc. RT,RB,RA 


CR[CRO] 


Extended mnemonic for 
subfco RT,RB,RA 


XER[SO, OV] 


Extended mnemonic for 
subfco. RT,RB,RA 


CRI[CRO] 
XER[SO, OV] 


9-177 


subi 


RT, RA, IM 


Subtract EXTS(IM) from (RA|0). 
Place result in RT. 

Extended mnemonic for 

addi RT,RA,—IM 


9-9 


subic 


RT, RA, IM 


Subtract EXTS(IM) from (RA). 

Place result in RT. 

Place carry-out in XER[CA]. 
Extended mnemonic for 
addic RT,RA,—-IM 


subic. 


RT, RA, IM 


Subtract EXTS(IM) from (RA). 

Place result in RT. 

Place carry-out in XER[CA]. 
Extended mnemonic for 
addic. RT,RA,-IM 


CR[CRO] 


subis 


RT, RA, IM 


Subtract (IM || 1®0) from (RA|O). 


Place result in RT. 
Extended mnemonic for 
addis RT,RA,-IM 
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Table B-5. Extended Mnemonics for PPC405 (continued) 


Mnemonic 


twedqi 


Operands 


RA, IM 


twgei 


twoti 


twlei 


twigei 


twigti 


twllei 


twilti 


twingi 


twinli 


twlti 


twnei 


twngi 


twnli 


Function 


Trap if (RA) equal to EXTS(IM). 
Extended mnemonic for 
twi 4,RA,IM 


Trap if (RA) greater than or equal to EXTS(IM). 
Extended mnemonic for 
twi 12,RA,IM 


Trap if (RA) greater than EXTS(IM). 
Extended mnemonic for 
twi 8,RA,IM 


Trap if (RA) less than or equal to EXTS(IM). 
Extended mnemonic for 
twi 20,RA,IM 


Trap if (RA) logically greater than or equal to 
EXTS(IM). 

Extended mnemonic for 

twi 5,RA,IM 


Trap if (RA) logically greater than EXTS(IM). 
Extended mnemonic for 
twi 1,RA,IM 


Trap if (RA) logically less than or equal to EXTS(IM). 


Extended mnemonic for 
twi 6,RA,IM 


Trap if (RA) logically less than EXTS(IM). 
Extended mnemonic for 
twi 2,RA,IM 


Trap if (RA) logically not greater than EXTS(IM). 
Extended mnemonic for 
twi 6,RA,IM 


Trap if (RA) logically not less than EXTS(IM). 
Extended mnemonic for 
twi 5,RA,IM 


Trap if (RA) less than EXTS(IM). 
Extended mnemonic for 
twi 16,RA,IM 


Trap if (RA) not equal to EXTS(IM). 
Extended mnemonic for 
twi 24,RA,IM 


Trap if (RA) not greater than EXTS(IM). 
Extended mnemonic for 
twi 20,RA,IM 


Trap if (RA) not less than EXTS(IM). 
Extended mnemonic for 
twi 12,RA,IM 


Other Registers 
Changed 


Page 
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B.5 Storage Reference Instructions 


The PPC405 uses load and store instructions to transfer data between memory and the general 
purpose registers. Load and store instructions operate on byte, halfword and word data. The storage 
reference instructions also support loading or storing multiple registers, character strings, and byte- 
reversed data. Table B-6 shows the storage reference instructions available for use in the PPC405. 


Table B-6. Storage Reference Instructions 


Mnemonic 


Ibz 


Operands 


RT, D(RA) 


Function 


Load byte from EA = (RA|O) + EXTS(D) and pad left 
with zeroes, 
(RT) < 740 || MS(EA,1). 


Other Registers 
Changed 


Page 
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Ibzu 


RT, D(RA) 


Load byte from EA = (RAO) + EXTS(D) and pad left 
with zeroes, 

(RT) — 240 || MS(EA,1). 

Update the base address, 

(RA) <— EA. 


9-72 


Ibzux 


RT, RA, RB 


Load byte from EA = (RA|0) + (RB) and pad left with 
zeroes, 

(RT) — 240 || MS(EA,1). 

Update the base address, 

(RA) <— EA. 


9-73 


Ibzx 


RT, RA, RB 


Load byte from EA = (RA|0) + (RB) and pad left with 
zeroes, 
(RT) < 240 || MS(EA,1). 


9-74 


lha 


RT, D(RA) 


Load halfword from EA = (RA|0) + EXTS(D) and sign 
extend, 
(RT) — EXTS(MS(EA,2)). 


9-75 


Ihau 


RT, D(RA) 


Load halfword from EA = (RA|0) + EXTS(D) and sign 
extend, 

(RT) — EXTS(MS(EA,2)). 

Update the base address, 

(RA) < EA. 


9-76 


Ihaux 


RT, RA, RB 


Load halfword from EA = (RA|0) + (RB) and sign 
extend, 

(RT) — EXTS(MS(EA,2)). 

Update the base address, 

(RA) < EA. 


9-77 


Ihax 


RT, RA, RB 


Load halfword from EA = (RA|0) + (RB) and sign 
extend, 
(RT) — EXTS(MS(EA,2)). 


9-78 


Ihbrx 


RT, RA, RB 


Load halfword from EA = (RA|O) + (RB), then reverse 
byte order and pad left with zeroes, 
(RT) — ‘80 || MS(EA+1,1) || MS(EA,1). 


9-79 


Ihz 


RT, D(RA) 


Load halfword from EA = (RA|0) + EXTS(D) and pad 
left with zeroes, 
(RT) — 180 || MS(EA,2). 


9-80 
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Table B-6. Storage Reference Instructions (continued) 


Other Registers 


Mnemonic) Operands Function Changed Page 
Ihzu RT, D(RA) Load halfword from EA = (RA|0) + EXTS(D) and pad 9-80 


left with zeroes, 

(RT) — 180 || MS(EA,2). 
Update the base address, 
(RA) < EA. 


Ihzux RT, RA, RB Load halfword from EA = (RA|0) + (RB) and pad left 9-82 
with zeroes, 

(RT) <— 180 || MS(EA,2). 
Update the base address, 
(RA) <— EA. 


Ihzx RT, RA, RB Load halfword from EA = (RA|O) + (RB) and pad left 9-83 
with zeroes, 
(RT) — 180 || MS(EA,2). 


Imw RT, D(RA) Load multiple words starting from 9-84 
EA = (RA|0) + EXTS(D). 

Place into consecutive registers, RT through 
GPR(31). 

RA is not altered unless RA = GPR(31). 


Iswi RT, RA, NB Load consecutive bytes from EA = (RAO). 9-85 
Number of bytes n = 32 if NB = 0, else n= NB. 
Stack bytes into words in CEIL(n/4) 
consecutive registers starting with RT, to 
Reina < ((RT + CEIL(n/4) — 1) % 32). 
GPR(0) is consecutive to GPR(31). 

RA is not altered unless RA = Reya_- 


Iswx RT, RA, RB Load consecutive bytes from EA=(RA|0)+(RB). 9-87 
Number of bytes n = XER[TBC]. 

Stack bytes into words in CEIL(n/4) consecutive 
registers starting with RT, to 

Reina < ((RT + CEIL(1/4) — 1) % 32). 

GPR(0) is consecutive to GPR(31). 

RA is not altered unless RA = Reya_- 

RB is not altered unless RB = Reya_- 

If n=0, content of RT is undefined. 


lwarx RT, RA, RB Load word from EA = (RA|O) + (RB)and place in RT, 9-89 
(RT) — MS(EA,4). 
Set the Reservation bit. 


lwbrx RT, RA, RB Load word from EA = (RA|0) + (RB) then reverse byte 9-90 

order, 

(RT) — MS(EA+3,1) || MS(EA+2,1) || 
MS(EA+1,1) || MS(EA,1). 


lwz RT, D(RA) Load word from EA = (RA|O) + EXTS(D) and place in 9-91 
RT, 
(RT) — MS(EA,4). 
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Table B-6. Storage Reference Instructions (continued) 


Mnemonic 


Iwzu 


Operands 


RT, D(RA) 


Function 


Load word from EA = (RA|O) + EXTS(D) and place in 
RT, 

(RT) — MS(EA,4). 

Update the base address, 

(RA) < EA. 


Other Registers 
Changed 


Page 
9-92 


lwzux 


RT, RA, RB 


Load word from EA = (RA|0) + (RB) and place in RT, 
(RT) — MS(EA,4). 

Update the base address, 

(RA) < EA. 


9-93 


lwzx 


RT, RA, RB 


Load word from EA = (RA|0) + (RB) and place in RT, 
(RT) <— MS(EA,4). 


9-94 


stb 


RS, D(RA) 


Store byte (RS)24.31 in memory at 
EA = (RA|O) + EXTS(D). 


9-156 


stbu 


RS, D(RA) 


Store byte (RS)24.31 in memory at 
EA = (RAO) + EXTS(D). 

Update the base address, 

(RA) < EA. 


9-157 


stbux 


RS, RA, RB 


Store byte (RS)24.31 in memory at 
EA = (RA|O) + (RB). 

Update the base address, 

(RA) <— EA. 


9-158 


stbx 


RS, RA, RB 


Store byte (RS)24.31 in memory at 
EA = (RA|O) + (RB). 


9-159 


sth 


RS, D(RA) 


Store halfword (RS)16.31 in memory at 
EA = (RA|O) + EXTS(D). 


9-160 


sthbrx 


RS, RA, RB 


Store halfword (RS) 16.3; byte-reversed in memory at 
EA = (RA|O) + (RB). 
MS(EA, 2) <— (RS)o4:31 Il (RS) 16:23 


9-161 


sthu 


RS, D(RA) 


Store halfword (RS)1g.31 in memory at 
EA = (RA|O) + EXTS(D). 

Update the base address, 

(RA) < EA. 


9-162 


sthux 


RS, RA, RB 


Store halfword (RS)1g.31 in memory at 
EA = (RA|O) + (RB). 

Update the base address, 

(RA) < EA. 


9-163 


sthx 


RS, RA, RB 


Store halfword (RS) 1g.31 in memory at 
EA = (RA|O) + (RB). 


9-164 


stmw 


RS, D(RA) 


Store consecutive words from RS through GPR(31) in 
memory starting at 
EA = (RA|O) + EXTS(D). 


9-165 
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Table B-6. Storage Reference Instructions (continued) 


Mnemonic 


stswi 


Operands 


RS, RA, NB 


Function 


Store consecutive bytes in memory starting at 
EA=(RA|0). 

Number of bytes n = 32 if NB = 0, else n= NB. 
Bytes are unstacked from CEIL(n/4) consecutive 
registers starting with RS. 

GPR(0) is consecutive to GPR(31). 


Other Registers 
Changed 


Page 
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stswx 


RS, RA, RB 


Store consecutive bytes in memory starting at 
EA=(RA|0)+(RB). 

Number of bytes n = XER[TBC]. 

Bytes are unstacked from CEIL(n/4) 
consecutive registers starting with RS. 
GPR(0) is consecutive to GPR(31). 


9-166 


9-167 


stw 


RS, D(RA) 


Store word (RS) in memory at 
EA = (RA|O) + EXTS(D). 


9-166 


9-169 


stwbrx 


RS, RA, RB 


Store word (RS) byte-reversed in memory at EA = 
(RA|O) + (RB). 
MS(EA, 4) <— (RS)o4:31 Il (RS) 46:23 II 

(RS)g.15 Il (RS)o:7 


9-166 


9-170 


stwex. 


RS, RA, RB 


Store word (RS) in memory at EA = (RA|O) + (RB) 
only if the reservation bit is set. 
if RESERVE = 1 then 
MS(EA, 4) < (RS) 
RESERVE < 0 
(CR[CRO]) < 70 || 1 || XERgo 
else 
(CR[CRO]) <— 70 || 0 || XER¢o, 


9-166 


9-171 


stwu 


RS, D(RA) 


Store word (RS) in memory at EA = (RA|O) + 
EXTS(D). 

Update the base address, 

(RA) < EA. 


9-166 


9-173 


stwux 


RS, RA, RB 


Store word (RS) in memory at EA = (RA|O) + (RB). 


Update the base address, 
(RA) < EA. 


9-166 


9-174 


stwx 


RS, RA, RB 


Store word (RS) in memory at 
EA = (RA|O) + (RB). 


9-166 


9-175 
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B.6 Arithmetic and Logical Instructions 


Table B-7 lists the arithmetic and logical instructions. Arithmetic operations are performed on integer 


or ordinal operands stored in registers. Instructions using two operands are defined in a three- 


operand format, where the operation is performed on the operands stored in two registers, and the 
result is placed in a third register. Instructions using one operand are defined in a two-operand format, 
where the operation is performed on the operand in one register, and the result is placed in another 
register. Several instructions have immediate formats, in which one operand is coded as part of the 
instruction itself. Most arithmetic and logical instructions can optionally set the Condition Register 
(CR) based on the outcome of the instruction. 


Table B-7. Arithmetic and Logical Instructions 


Other Registers 
Mnemonic Operands Function Changed Page 
add RT, RA, RB __ | Add (RA) to (RB). 9-6 
add. Place result in RT. CRICRO] 
addo XER[SO, OV] 
addo. CR[CRO] 
XER[SO, OV] 
addc RT, RA, RB __ | Add (RA) to (RB). 9-7 
Place result in RT. 
adde. Place carry-out in XER[CA]. CRICRO] 
addco XER[SO, OV] 
addco. CR[CRO] 
XER[SO, OV] 
adde RT, RA, RB | Add XER[CA], (RA), (RB). 9-9 
Place result in RT. 
adde. Place carry-out in XER[CA]. CRICRO] 
addeo XER[SO, OV] 
addeo. CR[CRO] 
XER[SO, OV] 
addi RT, RA, IM Add EXTS(IM) to (RAO). 9-9 
Place result in RT. 
addic RT, RA, IM Add EXTS(IM) to (RAO). 9-10 
Place result in RT. 
Place carry-out in XER[CA]. 
addic. RT, RA, IM Add EXTS(IM) to (RAO). CR[CRO] 9-11 
Place result in RT. 
Place carry-out in XER[CA]. 
addis RT, RA, IM | Add (IM || 1°0) to (RAJO). 9-12 
Place result in RT. 
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Table B-7. Arithmetic and Logical Instructions (continued) 


Other Registers 


Mnemonic Operands Function Changed Page 
addme RT, RA Add XER[CA], (RA), (-1). 9-13 
Bddmne: ios Seo tere Cae nO 
addmeo XER[SO, OV] 
addmeo. CR[CRO] 

XER[SO, OV] 
addze RT, RA Add XER[CA] to (RA). 9-14 
addze. pee a eae a ie 
addzeo XER[SO, OV] 
addzeo. CR[CRO] 

XER[SO, OV] 
and RA, RS, RB__| AND (RS) with (RB). 9-15 
end: Place result in RA. CRICRO] 
ande RA, RS, RB__| AND (RS) with —(RB). 9-16 
aide. Place result in RA. CRICRO] 
andi. RA, RS, IM__| AND (RS) with (180 |] IM). CRI[CRO] 9-17 

Place result in RA. 
andis. RA, RS, IM | AND (RS) with (IM || 10). CR[CRO] 9-18 
Place result in RA. 

cntizw RA, RS Count leading zeros in RS. 9-38 
enilow. Place result in RA. CRICRO] 
divw RT, RA, RB__| Divide (RA) by (RB), signed. 9-59 
divw: Place result in RT. CRICRO] 
divwo XER[SO, OV] 
divwo. CR[CRO] 

XER[SO, OV] 
divwu RT, RA, RB Divide (RA) by (RB), unsigned. 9-60 
aigwil: Place result in RT. CRICRO] 
divwuo XER[SO, OV] 
divwuo. CR[CRO] 

XER[SO, OV] 
eqv RA, RS, RB__| Equivalence of (RS) with (RB). 9-62 
eqv. (RA) <— —((RS) ® (RB)) CRICRO] 
extsb RA, RS Extend the sign of byte (RS)o4-31. 9-63 
Shieb. Place the result in RA. CRICRO] 
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Table B-7. Arithmetic and Logical Instructions (continued) 


Other Registers 


Mnemonic) Operands Function Changed Page 
extsh RA, RS Extend the sign of halfword (RS) 16-31. 9-64 
Bxich. Place the result in RA. CRICRO] 
mulhw RT, RA, RB Multiply (RA) and (RB), signed. 9-127 
Place hi-order result in RT. 
ule prodg.eg <— (RA) x (RB) (signed). CRICRO] 
(RT) <— prodo.31, 
mulhwu RT, RA, RB Multiply (RA) and (RB), unsigned. 9-128 
Place hi-order result in RT. 
mulhwu. prodg.¢3 < (RA) x (RB) (unsigned). CRICRO] 
(RT) <— prodo.31, 
mulli RT, RA, IM Multiply (RA) and IM, signed. 9-129 
Place lo-order result in RT. 
prodg.47 < (RA) x IM (signed) 
(RT) <— prody¢.47 
mullw RT, RA, RB Multiply (RA) and (RB), signed. 9-130 
Place lo-order result in RT. 
ule prodg.eg < (RA) x (RB) (signed). CRICHO) 
mullwo (RT) <— prod3e.¢63. XER[SO, OV] 
mullwo. CR[CRO] 
XER[SO, OV] 
nand RA, RS, RB__| NAND (RS) with (RB). 9-131 
and: Place result in RA. CRICRO] 
neg RT, RA Negative (two’s complement) of RA. 9-132 
neg. (RT) < —(RA) + 1 CRICRO] 
nego XER[SO, OV] 
nego. CR[CRO] 
XER[SO, OV] 
nor RA, RS, RB | NOR (RS) with (RB). 9-139 
ae Place result in RA. CRICRO] 
or RA, RS, RB__| OR (RS) with (RB). 9-134 
oe Place result in RA. CRICRO] 
orc RA, RS, RB__| OR (RS) with -(RB). 9-134 
ore Place result in RA. CRICRO] 
ori RA, RS, IM OR (RS) with (160 || IM). 9-142 
Place result in RA. 
oris RA, RS, IM__| OR (RS) with (IM || 10). 9-143 
Place result in RA. 
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Table B-7. Arithmetic and Logical Instructions (continued) 


Other Registers 


Mnemonic) Operands Function Changed Page 
subf RT, RA, RB __| Subtract (RA) from (RB). 9-176 
subf. (RT) <— —(RA) + (RB) + 1. CRICRO] 
subfo XER[SO, OV] 
subfo. CR[CRO] 
XER[SO, OV] 
subfc RT, RA, RB Subtract (RA) from (RB). 9-177 
(RT) < —(RA) + (RB) + 1. 
subfc. Place carry-out in XER[CA]. CBICHOI 
subfco XER[SO, OV] 
subfco. CR[CRO] 
XER[SO, OV] 
subfe RT, RA, RB Subtract (RA) from (RB) with carry-in. 9-178 
(RT) <— =(RA) + (RB) + XER[CA]. 
Sub: Place carry-out in XER[CA]. CAIRO] 
subfeo XER[SO, OV] 
subfeo. CR[CRO] 
XER[SO, OV] 
subfic RT, RA, IM Subtract (RA) from EXTS(IM). 9-179 
(RT) <— -=(RA) + EXTS(IM) + 1. 
Place carry-out in XER[CA]. 
subfme RT, RA, RB Subtract (RA) from (—1) with carry-in. 9-180 
(RT) <— =(RA) + (-1) + XER[CA]. 
subfme. Place carry-out in XER[CA]. CRICRO] 
subfmeo XER[SO, OV] 
subfmeo. CR[CRO] 
XER[SO, OV] 
subfze RT, RA, RB Subtract (RA) from zero with carry-in. 9-180 
(RT) <— =(RA) + XER[CA]. 
subfze. Place carry-out in XER[CA]. eBICR?] 
subfzeo XER[SO, OV] 
subfzeo. CR[CRO] 
XER[SO, OV] 
xor RA, RS, RB__| XOR (RS) with (RB). 9-198 
ear Place result in RA. CRICRO] 
xori RA, RS, IM___| XOR (RS) with ('60 |] IM). 9-199 
Place result in RA. 
xoris RA, RS, IM | XOR (RS) with (IM |] 180). 9-200 


Place result in RA. 
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B.7 Condition Register Logical Instructions 


CR logical instructions combine the results of several comparisons without incurring the overhead of 


conditional branching. These instructions can significantly improve code performance if multiple 


conditions are tested before making a branch decision. Table B-8 summarizes the CR logical 


instructions. 


Table B-8. Condition Register Logical Instructions 


Other Registers 

Mnemonic | Operands Function Changed Page 

crand BT, BA, BB__| AND bit (CRga) with (CRep). 9-39 
Place result in CRer- 

crandc BT, BA, BB_ | AND bit (CRga) with —(CRpp). 9-40 
Place result in CRet- 

creqv BT, BA, BB_ | Equivalence of bit CRga with CRegp. 9-41 
CRet - —=(CRpa ® CRpp) 

crnand BT, BA, BB_ | NAND bit (CRga) with (CRep). 9-42 
Place result in CRert- 

crnor BT, BA, BB_ | NOR bit (CRga) with (CRgp). 9-43 
Place result in CRet- 

cror BT, BA, BB_ | OR bit (CRga) with (CRpgp). 9-44 
Place result in CRet- 

crore BT, BA, BB | OR bit (CRga) with — (CRep). 9-45 
Place result in CRet- 

crxor BT, BA, BB_ | XOR bit (CRga) with (CRgp). 9-46 
Place result in CRert- 

merf BF, BFA Move CR field, (CR[CRn]) < (CR[CRm]) 9-107 
where m < BFA and n < BF. 
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B.8 Branch Instructions 


The architecture provides conditional and unconditional branches to any storage location. The 


conditional branch instructions test condition codes set previously and branch accordingly. 

Conditional branch instructions may decrement and test the Count Register (CTR) as part of 
determination of the branch condition and may save the return address in the Link Register (LR). The 
target address for a branch may be a displacement from the current instruction address (CIA), or may 


be contained in the LR or CTR, or may be an absolute address. 


Table B-9. Branch Instructions 


Other Registers 
Mnemonic) Operands Function Changed Page 
b target Branch unconditional relative. 9-19 
LI < (target — CIA)g-29 
NIA <— CIA + EXTS(LI || 20) 
ba Branch unconditional absolute. 
LI <— targetg.o9 
NIA <— EXTS(LI || 20) 
bl Branch unconditional relative. (LR) < CIA + 4. 
LI < (target — CIA)g-.29 
NIA <— CIA + EXTS(LI || 20) 
bla Branch unconditional absolute. (LR) < CIA + 4. 
LI <— targetg.o9 
NIA — EXTS(LI |] 20) 
bce BO, BI, target | Branch conditional relative. CTR if BOa =0. | 9-20 
BD < (target = CIA) 16:29 
NIA — CIA + EXTS(BD |] 20) 
bca Branch conditional absolute. CTR if BO» = 0. 
BD < targetyg-29 
NIA <— EXTS(BD || 20) 
bel Branch conditional relative. CTR if BOs = 0. 
BD < (target — CIA)16-09 (LR) <— CIA + 4. 
NIA <— CIA + EXTS(BD |] 20) 
bcla Branch conditional absolute. CTR if BOs = 0. 
BD < targety6.29 (LR) < CIA + 4. 
NIA <— EXTS(BD || 20) 
bectr BO, BI Branch conditional to address in CTR. CTR if Bon =0. | 9-26 
bectrl ees | 2 instruction, CTR if BO> = 0. 
ed (LR) < CIA + 4. 
belr BO, BI Branch conditional to address in LR. CTR if Bon =0. | 9-30 
‘bert See Sie. instruction, CTR if BO» = 0. 
poe ; (LR) < CIA + 4. 
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B.9 Comparison Instructions 


Comparison instructions perform arithmetic and logical comparisons between two operands and set 
one of the eight condition code register fields based on the outcome of the comparison. Table B-10 
shows the comparison instructions supported by the PPC405 core. 


Table B-10. Comparison Instructions 


Other 
Registers 
Mnemonic | Operands Function Changed Page 
cmp BF, 0, RA, Compare (RA) to (RB), signed. 9-34 
RB Results in CR[CRn], where n= BF. 
cmpi BF, 0, RA, Compare (RA) to EXTS(IM), signed. 9-35 
IM Results in CR[CRn], where n= BF. 
cmpl BF, 0, RA, Compare (RA) to (RB), unsigned. 9-36 
RB Results in CR[CRn], where n= BF. 
cmpli BF,0,RA, | Compare (RA) to ('80 || IM), unsigned. 9-37 
IM Results in CR[CRn], where n= BF. 
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B.10 Rotate and Shift Instructions 


Rotate and shift instructions rotate and shift operands which are stored in the general purpose 
registers. Rotate instructions can also mask rotated operands. Table B-11 shows the PPC405 rotate 
and shift instructions. 


Table B-11. Rotate and Shift Instructions 


Other Registers 
Mnemonic | Operands Function Changed Page 
rlwimi RA, RS, SH, | Rotate left word immediate, then insert according to 9-146 
es MB, ME mask. 
rlwimi. r < ROTL((RS), SH) CR[CRO] 
m < MASK(MB, ME) 
(RA) < (rA m) v ((RA) A =m) 
rlwinm RA, RS, SH, | Rotate left word immediate, then AND with mask. 9-147 
MB, ME r < ROTL((RS), SH) 
rlwinm. m < MASK(MB, ME) CR[CRO] 
(RA) < (ra m) 
rlwnm RA, RS, RB, | Rotate left word, then AND with mask. 9-150 
MB, ME r < ROTL((RS), (RB)97-31) 
rlwnm. m < MASK(MB, ME) CR[CRO] 
(RA) < (ra m) 
slw RA, RS, RB_| Shift left (RS) by (RB)57-31. 9-152 
n <— (RB)o97:31, 
slw. r < ROTL((RS), n). CRICRO] 
if (RB)og = 0 thenm « MASK(O, 31 —n) 
elsem < 20, 
(RA) — ram. 
sraw RA, RS, RB _| Shift right algebraic (RS) by (RB)o7.31. 9-153 
n <— (RB)o7:31- 
sraw. r <— ROTL((RS), 32-1). CRICRO] 
if (RB)og = Othenm < MASK(n, 31) 
elsem < 20, 
s < (RS)o, 
(RA) < (r A m) v (88s A —m). 
XER[CA] < s A ((r A —m) #0). 
srawi RA, RS, SH__| Shift right algebraic (RS) by SH. 9-154 
: n < SH. 
srawi. r < ROTL((RS), 32—n). CRICRO] 
m <— MASK(n, 31). 
s < (RS)o, 
(RA) < (r A m) v (88s A —m). 
XER[CA] < s A ((r A —m)#0). 
srw RA, RS, RB_| Shift right (RS) by (RB)57-34. 9-155 
n <— (RB)o7:31- 
srw. r <— ROTL((RS), 32—n). CRICRO] 
if (RB)og = Othenm < MASK(n, 31) 
elsem < 20, 
(RA) ram. 
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B.11 Cache Control Instructions 


Cache control instructions allow the user to indirectly control the contents of the data and instruction 
caches. The user may fill, flush, invalidate and zero blocks (16-byte lines) in the data cache. The user 


may also invalidate congruence classes in both caches and invalidate individual lines in the 


instruction cache. 


Table B-12. Cache Control Instructions 


Other 
Registers 

Mnemonic | Operands Function Changed Page 

dcba RA, RB Speculatively establish the data cache block which 9-47 
contains the EA (RA|0) + (RB). 

dcbf RA, RB Flush (store, then invalidate) the data cache block which 9-49 
contains the EA (RA|0) + (RB). 

debi RA, RB Invalidate the data cache block which contains the EA 9-50 
(RA|O) + (RB). 

dcbst RA, RB Store the data cache block which contains the EA 9-51 
(RA|O) + (RB). 

dcbt RA, RB Load the data cache block which contains the EA 9-52 
(RA|O) + (RB). 

dcbtst RA,RB Load the data cache block which contains the EA 9-53 
(RA|O) + (RB). 

dcbz RA, RB Zero the data cache block which contains the EA 9-54 
(RA|O) + (RB). 

dccci RA, RB Invalidate the data cache congruence class associated 9-56 
with the EA (RA|0) + (RB). 

dcread RT, RA, RB_ | Read either tag or data information from the data cache 9-57 
congruence class associated with the EA (RA|0) + (RB). 
Place the results in RT. 

icbi RA, RB Invalidate the instruction cache block which contains the 9-65 
EA (RA|O) + (RB). 

icbt RA, RB Load the instruction cache block which contains the EA 9-66 
(RA|O) + (RB). 

iccci RA, RB Invalidate instruction cache. 9-67 

icread RA, RB Read either tag or data information from the instruction 9-68 
cache congruence class associated with the EA 
(RA|O) + (RB). 
Place the results in ICDBDR. 
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B.12 Interrupt Control Instructions 


The interrupt control instructions allow the user to move data between general purpose registers and 
the machine state register, return from interrupts and enable or disable maskable external interrupts. 
Table B-13 shows the interrupt control instruction set. 


Table B-13. Interrupt Control Instructions 


Other Registers 
Mnemonic) Operands Function Changed Page 


mfmsr RT Move from MSR to RPT, 9-111 
(RT) <— (MSR). 


mtmsr RS Move to MSR from RS, 9-118 
(MSR) < (RS). 


rfci Return from critical interrupt 9-144 
(PC) < (SRR2). 
(MSR) < (SRR). 


rfi Return from interrupt. 9-144 
(PC) < (SRRO). 
(MSR) < (SRRY1). 


wrtee RS Write value of RSj¢ to the External Enable bit 9-196 
(MSR[EE}). 
wrteei E Write value of E to the External Enable bit (MSR[EE]). 9-197 


B.13 TLB Management Instructions 


The TLB management instructions read and write entries of the TLB array in the MMU, search the 
TLB array for an entry which will translate a given address, invalidate all TLB entries, and synchronize 
TLB updates with other processors. 


Table B-14. TLB Management Instructions 


Other Registers 
Mnemonic) Operands Function Changed Page 


tlbia All of the entries in the TLB are invalidated and 9-183 
become unavailable for translation by clearing the 
valid (V) bit in the TLBHI portion of each TLB entry. 
The rest of the fields in the TLB entries are 
unmodified. 
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Table B-14. TLB Management Instructions (continued) 


Other Registers 
Mnemonic Operands Function Changed Page 


tlbre RT, RA,WS If WS = 0: 9-184 
Load TLBHI portion of the selected TLB entry into RT. 
Load the PID register with the contents of the TID 
field of the selected TLB entry. 

(RT) <— TLBHI[(RA)] 
(PID) <— TLB[(RA)]tip 


lf WS = 1: 

Load TLBLO portion of the selected TLB entry into 
RT. 

(RT) < TLBLO[(RA)] 


tlbsx RT,RA,RB Search the TLB array for a valid entry which 9-186 
translates the EA 
EA = (RA|O) + (RB). 
If found, 

(RT) < Index of TLB entry. 
If not found, 

(RT) Undefined. 


tlbsx. If found, CR[CRO]it,.6T,s0 
(RT) < Index of TLB entry. 
If not found, 
(RT) Undefined. 


tlbsync tlbsync does not complete until all previous TLB- 9-187 
update instructions executed by this processor have 
been received and completed by all other processors. 


For the PPC405 core, tlbsync is a no-op. 


tlbwe RS, RA,WS_ | If WS = 0: 9-188 
Write TLBHI portion of the selected TLB entry from 
RS. 

Write the TID field of the selected TLB entry from the 
PID register. 

TLBHI[(RA)] <— (RS) 

TLB[(RA)]nip <— (PID)24:31 


If WS = 1: 

Write TLBLO portion of the selected TLB entry from 
RS. 

TLBLO[(RA)] < (RS) 
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B.14 Processor Management Instructions 


The processor management instructions move data between GPRs and SPRs and DCRs in the 
PPC405 core; these instructions also provide traps, system calls and synchronization controls. 


Table B-15. Processor Management Instructions 


Mnemonic) Operands 


eieio 


Function 


Storage synchronization. All loads and stores that 
precede the eieio instruction complete before any 
loads and stores that follow the instruction access 
main storage. 


Implemented as syne, which is more restrictive. 


Other Registers 
Changed 


Page 
9-61 


isync 


Synchronize execution context by flushing the 
prefetch queue. 


merxr 


BF 


Move XER[0:3] into field CRn, where n<—BF. 
CR[CRn] < (XER[SO, OV, CA)). 
(XER[SO, OV, CA]) < °0. 


mfcr 


RT 


Move from CR to RT, 
(RT) <— (CR). 


mfdcr 


RT, DCRN 


Move from DCR to RT, 
(RT) < (DCR(DCRN)). 


mfspr 


RT, SPRN 


Move from SPR to RT, 
(RT) <— (SPR(SPRN)). 


mtcrf 


FXM, RS 


Move some or all of the contents of RS into CR as 
specified by FXM field, 

mask < 4(FXMbo) || 4(FXMj) [I --- Il 

“(FXMs) || “(FXMr). 

(CR)<((RS) A mask) v (CR) A —mask). 


midcr 


DCRN, RS 


Move to DCR from RS, 
(DCR(DCRN)) < (RS). 


9-117 


mtspr 


SPRN, RS 


Move to SPR from RS, 
(SPR(SPRN)) <— (RS). 


9-119 


sc 


System call exception is generated. 
(SRR1) — (MSR) 

(SRRO) < (PC) 

PC & EVPRo-15 || 0x0C00 
(MSR[WE, PR, EE, PE, DR, IR]) < 0 


9-151 


sync 


Synchronization. All instructions that precede sync 
complete before any instructions that follow sync 
begin. 

When sync completes, all storage accesses initiated 
before sync will have completed. 


9-182 


TO, RA, RB 


Trap exception is generated if, comparing (RA) with 
(RB), any condition specified by TO is true. 


9-190 
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Table B-15. Processor Management Instructions (continued) 


Other Registers 


Mnemonic) Operands Function Changed Page 
twi TO, RA, IM Trap exception is generated if, comparing (RA) with 9-193 
EXTS(IM), any condition specified by TO is true. 
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Appendix C. Code Optimization and Instruction Timings 


The code optimization guidelines in “Code Optimization Guidelines” and the information describing 
instruction timings in “Instruction Timings,” on page C-3 can help compiler, system, and application 
programmers produce high-performance code and determine accurate execution times. 


C.1 Code Optimization Guidelines 
The following guidelines can help to reduce program execution times. 


C.1.1 Condition Register Bits for Boolean Variables 


Compilers can use Condition Register (CR) bits to store boolean variables, where 0 and 1 represent 
False and True values, respectively. This generally improves performance, compared to using 
General Purpose Registers (GPRs) to store boolean variables. Most common operations on boolean 
variables can be accomplished using the CR Logical instructions. 


C.1.2 CR Logical Instruction for Compound Branches 
For example, consider the following pseudocode: 
if (Var28 || Var29 || Var30 || Var 31) branch to target 


Var28—Var31 are boolean variables, maintained as bits in the CR[CR7] field (CRog.31). The value 1 
represents True; 0 represents False. 


This could be coded with branches as: 


bt 28, target 
bt 29, target 
bt 30, target 
bt 31, target 


Generally faster, functionally equivalent code, using CR Logical instructions, follows: 


crcr 2, 28, 29 
cror 2, 2, 30 
cror 2,2, 31 
bt 2, target 


C.1.3. Floating-Point Emulation 
Two ways of handling floating-point emulation are available. 
The preferred method is a call interface to subroutines in a floating-point emulation run-time library. 


Alternatively, code can use the PowerPC floating point instructions. The PPC405, an integer 
processor, does not recognize these instructions and will take an illegal instruction interrupt. The 
interrupt handler can be written to determine the instruction opcode and execute appropriate (integer- 
based) library routines to provide the equivalent function. 


Code Optimization and Instruction Timings C-1 


Because this method adds interrupt context switching time to the execution time of library routines 
that would have been called directly by the preferred method, it is not preferred. However, this method 
supports code that contains PowerPC floating-point instructions. 


C.1.4 Cache Usage 


Code and data can be organized, based on the size and structure of the instruction and data cache 
arrays, to minimize cache misses. 


In the cache arrays, any two addresses in which A,7.9¢ (the index) are the same, but which differ in 
Ao:m-1 (the tag), are called congruent. (This describes a two-way set-associative cache.) Ao7.3; define 
the 32 bytes in a cache line, the smallest object that can be brought into the cache. Only two 
congruent lines can be in the cache simultaneously; accessing a third congruent line causes the 
removal from the cache of one of the two lines previously there 


Table C-1 illustrates the value of m and the index size for the various cache array sizes. 


Table C-1. Cache Sizes, Tag Fields, and Lines 


Instruction Cache Array Data Cache Array 


Size | m(Tag Field Bits) | n(Lines) | Index Bits | m (Tag Field Bits) | n(Lines) | Index Bits 


) 20 (0:19) 64 21:26 

) 20 (0:19) 128 20:26 

| 
32KB 22 (0:21) 512 18:26 20 (0:19) 512 18:26 


Moving new code and data into the cache arrays occurs at the speed of external memory. Much faster 
execution is possible when all code and data is available in the cache. Organizing code to uniformly 
use Aj,-2g minimizes the use of congruent addresses. 


C.1.5 CR Dependencies 


For CR-setting arithmetic, compare, CR-logical, and logical instructions, and the CR-setting merf, 
merxr, and mterf instructions, put two instructions between the CR-setting instruction and a Branch 
instruction that uses a bit in the CR field set by the CR-setting instruction. 


C.1.6 Branch Prediction 


Use the Y-bit in branch instructions to force proper branch prediction when there is a more likely 
prediction than the standard prediction. See “Branch Prediction” on page 2-26 for a more information 
about branch prediction. 


C.1.7 Alignment 


For speed, align all accesses on the appropriate operand-size boundary. For example, load/store 
word operands should be word-aligned, and so on. Hardware does not trap unaligned accesses; 
instead, two accesses are performed for a load or store of an unaligned operand that crosses a word 
boundary. Unaligned accesses that do not cross word boundaries are performed in one access. 
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Align branch targets that are unlikely to be hit by “fall-through” code on cache line boundaries (such 
as the address of functions such as strcpy), to minimize the number of unused instructions in cache 
line fills. 


C.2_ Instruction Timings 
The following timing descriptions consider only “first order” effects of cache misses in the ICU 


(instruction-side) and DCU (data-side) arrays. 


The timing descriptions do not provide complete descriptions of the performance penalty associated 
with cache misses; the timing descriptions do not consider bus contention between the instruction- 
side and the data-side, or the time associated with performing line fills or flushes. Unless specifically 
stated otherwise, the number of cycles apply to systems having zero-wait memory access. 


C.2.1 General Rules 

Instructions execute in order. 

All instructions, assuming cache hits, execute in one cycle, except: 

¢ Divide instructions execute in 35 clock cycles. 

¢ Branches execute in one or three clock cycles, as described in “Branches.” 

¢ MAC and multiply instructions execute in one to five cycles as described in “Multiplies.” 


¢ Aligned load/store instructions that hit in the cache execute in one clock cycle/word. See 
“Alignment” for information on execution timings for unaligned load/stores. 


¢ Inisolation, a data cache control instruction takes two cycles in the processor pipeline. However, 
subsequent DCU accesses are stalled until a cache control instruction finishes accessing the data 
cache array. 


Note: Note that subsequent DCU accesses do not remain stalled while transfers associated with 
previous data cache control instructions continue on the PLB. 


C.2.2 Branches 


Branch instructions are decoded in prefetch buffer 0 (PFBO) and the decode stage of the instruction 
pipeline. Branch targets, whether the branch is known or predicted taken, can be fetched from the 
PFBO and DCD stages. Incorrectly predicted branches can be corrected from the DCD or EXE 
(execute) stages of the pipeline. 


Branches can be known taken or known not taken, or can have address or condition dependencies. 
Branches having address dependencies are never predicted taken. The directions of conditional 
branches having no address dependencies are statically predicted. 


Conditional branches may depend on the results of an instruction that is changing the CR or the CTR. 
Address dependencies can occur when: 


¢ A belr instruction that is known taken, or unresolved, follows (immediately, or separated by only 
one instruction) a link updating instruction (mtlIr or a branch and link). 


¢ A bcctr instruction that is known taken, or unresolved, follows (immediately, or separated by only 
one instruction) a counter updating instruction (mtctr or a branch that decrements the counter). 
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Instruction timings for branch instructions follow: 


¢ Abranch known not taken (BKNT) executes in one clock cycle. By definition a BKNT does not have 
address or condition dependencies. 


¢ A branch known taken (BKT) by definition has no condition dependencies, but can have address 
dependencies.A BKT without address dependencies can execute in one clock cycle if it is first 
decoded from the PFBO stage, or in two clock cycles if it is first decoded in the DCD stage. A BKT 
having address dependencies can execute in two clock cycles if there is one instruction between 
the branch and the address dependency, or in three clock cycles if there are no instructions 
between the branch and address dependency. 


¢ A branch predicted not taken (BPNT), which must have condition dependencies, executes in one 
clock cycle if the prediction is correct. If the prediction is incorrect, the branch can take two or three 
cycles. If there was one instruction between the branch and the instruction causing the condition 
dependency, the branch executes in two cycles. If there were no instructions between the branch 
and the instruction causing the condition dependency, the branch executes in three clock cycles. 


¢ A branch that is correctly predicted taken (BPT), which must have condition dependencies, 
executes in one clock cycle, if it is first decoded from the PFBO stage, or two clock cycles if it is first 
decoded in the DCD stage. If the prediction is incorrect, the branch can take two or three cycles. If 
there is one instruction between the branch and the instruction causing the condition dependency, 
the branch executes in two cycles. If there are no instructions between the branch and the 
instruction causing the condition dependency, the branch executes in three clock cycles. 


C.2.3 Multiplies 


For multiply instructions having two word operands, hardware internal to the core automatically 
detects smaller operand sizes (by examining sign bit extension) to reduce the number of cycles 
necessary to complete the multiplication. 


The PPC405 also supports multiply accumulate (MAC) instructions and multiply instructions having 
halfword operands. 


Word and halfword multiply instructions are pipelined in the execution unit and use the same 
multiplication hardware. Because these instructions are pipelined in the execution stage they have 
latency and reissue rate cycle numbers. Under conditions to be described, a second multiply or MAC 
instruction can begin execution before the first multiply or MAC instruction completes. When these 
conditions are met, the reissue rate cycle numbers should be used; otherwise, the latency cycle 
numbers should be used. (A MAC or multiply instruction can follow another MAC or a multiply and still 
meet the conditions that support the use of the reissue rate cycle numbers. 


Use reissue rate cycle numbers for multiply or MAC instructions that are followed by another multiply 
or MAC instruction, and do not have an operand dependency from a previous multiply or MAC 
instruction. However, one operand dependency is allowed for reissue rate cycle numbers. Internal 
forwarding logic allows the accumulate value of a first MAC instruction to be used as the accumulate 
value of a second MAC instruction without affecting the reissue rate. 


Use latency cycle numbers for multiply or MAC instructions that are not followed by another multiply 
or MAC, or that have an operand dependency from a previous multiply or MAC instruction. However, 
accumulate-only dependencies between adjacent MAC instructions use reissue rate cyle numbers. 


An operand dependency exists when a second multiply or MAC instruction depends on the result of a 
first multiply or MAC instruction. 
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Table C-2 summarizes the multiply and MAC instruction timings. In the table, the syntax “[o]” indicates 
that the instruction has an “o” form that updates XER[SO,OV], and a “non-o” form. The syntax “[.]” 
indicates that the instruction has a “record” form that updates CR[CRO], and a “non-record” form. 


Table C-2. Multiply and MAC Instruction Timing 


Reissue Rate Latency 
Operation Cycles Cycles 


MAC and negative MAC instructions 


Halfword x Halfword 


mullhw[.], mullhwu[.], mulhhw({.], 
mulhhwu[.], 
mulchw/[.], mulchwu[.] 


mulli[.], mullw[o][.], 
mulhw([.], mulhwul[.] 


Halfword x Word 


mulli[.], mullw[o][.], 
mulhw([.], mulhwul[.] 


Word x Word 


mullw([o][.], mulhw[.], mulhwu[.] 4 5 


C.2.4 Scalar Load Instructions 


Generally, the PPC405 executes cachable load instructions that hit in the data cache array or line fill 
buffer, or noncachable load instructions that hit in the line fill buffer (when enabled), in one cycle. 
However, the pipelined nature of load instructions can even cause loads that hit in the cache or line fill 
buffer to appear to take extra cycles under some conditions. 


If a load is followed by an instruction that uses the load target as an operand, a load-use dependency 
exists. When the load target is returned, it is forwarded to the operand register of the “using” 
instruction. This forwarding results in an additional cycle of latency to a load immediately followed by 
a “using” instruction, causing the load to appear to execute in two cycles. 


To improve cache-to-core timing or data-side on-chip memory (OCM)- to-core timing, the system 
designer can disable operand forwarding from the data cache unit (DCU) or OCM to the core. When 
operand forwarding is disabled, the load data needed by the “using” instruction is placed in an 
intermediate latch before the load data is forwarded to the operand register of the “using” instruction. 
When the load target is returned, it is forwarded to the operand register of the “using” instruction. This 
introduces two additional cycles of latency to a load immediately followed by a “using” instruction, 
causing the load instruction to appear to execute in three cycles. 


Because the PPC405 can execute instructions that follow load misses if no load-use dependency 
exists, the load and the “using” instruction should be separated by two “non-using” instructions when 
possible. If only one instruction can be placed between the load and the “using” instruction, the load 
appears to execute in two cycles. 
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C.2.5 Scalar Store Instructions 


Cachable stores that miss in the DCU, and noncachable stores, are queued in the data cache so that 
the store appears to execute in a single cycle if operand-aligned. Under certain conditions, the DCU 

can pipeline up to three store instructions. (See Chapter 4, “Cache Operations,’ for more information.) 
stwcex. instructions that do not cause alignment errors execute in two cycles. 


C.2.6 Alignment in Scalar Load and Store Instructions 


The PPC405 requires an extra cycle to execute scalar loads and stores having unaligned big or little 
endian data (except for lwarx and stwex., which require word-aligned operands). If the target data is 
not operand aligned, and the sum of the least two significant bits of the effective address (EA) and the 
byte count is greater than four, the PPC405 decomposes a load or store scalar into two load or store 
operations. That is, the PPC405 never presents the DCU with a request for a transfer that crosses a 
word boundary. For example, a lwz with an EA of 0b11 causes the PPC405 to decompose the Iwz 
into two load operations. The first load operation is for a byte at the starting effective address; the 
second load operation is for three bytes, starting at the next word address. 

C.2.7 String and Multiple Instructions 


Calculating execution times for string and multiple instructions (Imw and stmw) instructions requires 
an understanding of data alignment, and of the behavior of the string instructions with respect to 
alignment. 


In the following example, the string contains 21 bytes. The first three bytes do not begin on a word 
boundary, and the final two bytes do not end on a word boundary. The PPC405 handles any 
unaligned leading bytes as a special case, then moves as many bytes as aligned words as possible, 
and finally handles any unaligned trailing bytes as a special case. 


In the following example, arrows indicate word boundaries (the address is an exact multiple of four); 
shaded boxes represent unaligned bytes. 


, mE 


The execution time of the string instruction is the sum of the: 
1. Cycles required to handle unaligned leading bytes; if any, add one clock cycle. 
In the example, there are unaligned leading bytes; this transfer adds one clock cycle. 


2. Cycles required to handle the number of word-aligned transfers required. Assuming data cache 
hits, each word-aligned transfer requires one clock cycle. 


In the example, there are four aligned words; this transfer requires four clock cycles. 
3. Cycles required to handle unaligned trailing bytes; if any, add one clock cycle. 
In the example, there are unaligned trailing bytes; this transfer adds one clock cycle. 


A string instruction operating on the example 21-byte string requires six clock cycles. 
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C.2.8 Loads and Store Misses 


Cachable stores that miss in the DCU, and noncachable stores, are queued internally in the DCU so 
that the store instruction appears to execute in one cycle. Under certain conditions, the DCU can 
pipeline up to three store instructions. (See the Chapter 4, “Cache Operations,” for more information.) 


Because the PPC405 can execute instructions that follow load misses if no load-use dependency 
exists, the load and the “using” instruction should be separated by “non-using” instructions whenever 
possible. The number of load miss penalty cycles incurred by a load that misses in the DCU or DCU 
line fill buffer is reduced by one cycle for every non-use instruction following the load. When the 
number of non-use instructions following the load is equal to or greater than the number of cycles that 
it takes to obtain the load data, the load instruction appears to execute in a single cycle. The number 
of cycles that it takes to obtain load data when it misses in the data cache and line fill buffer depends 
on whether operand forwarding is enabled or disabled and the system memory timing. 


C.2.9 Instruction Cache Misses 


Refer to “Instruction Processing” on page 2-23 for detailed information about the instruction queue 
and instruction fetching. Table C-3 illustrates instruction cache penalties for cachable and 
noncachable fetches that miss in the ICU array and line fill buffer. 


Table C-3. Instruction Cache Miss Penalties 


Type of ICU Request Miss Penalty Cycles 
Sequential 3 
Branch Taken from DCD 5 
Branch Taken from PFBO 4 


Table C-3 assumes that: 


*« The PPC405 and processor local bus (PLB) run at the same frequency 


¢ The PLB returns an address acknowledge during the first cycle in which the DCU asserts the PLB 
request 


¢ The target instruction is returned in the cycle following the address acknowledge cycle 


The penalty cycles shown for sequential ICU requests assume that the DCD stage and pre-fetch 
queue are filled with single-cycle nonbranching instructions or BKNT branch instructions. The penalty 
cycles for the remaining two rows are for taken branches from DCD and PFBO, respectively. 
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rlwimi. 9-146 
rlwinm 9-147 
rlwinm. 9-147 
rlwnm 9-150 
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sc 9-151 

slw 9-152 

slw. 9-152 
sraw 9-153 
sraw. 9-153 
srawi 9-154 
srawi. 9-154 
srw 9-155 
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srw. 9-155 
sto 9-156 
stbu 9-157 
stbux 9-158 
stbx 9-159 
sth 9-160 
sthbrx 9-161 
sthu 9-162 
sthux 9-163 
sthx 9-164 
stmw 9-165 
stswi 9-166 
stswx 9-167 
stw 9-169 
stwbrx 9-170 
stwcex. 9-171 
stwu 9-173 
stwux 9-174 
stwx 9-175 
subf 9-176 
subf. 9-176 
subfc 9-177 
subfc. 9-177 
subfco 9-177 
subfco. 9-177 
subfe 9-178 
subfe. 9-178 
subfeo 9-178 
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subfic 9-179 
subfme 9-180 
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subfmeo 9-180 
subfmeo. 9-180 
subfo 9-176 
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subfze 9-181 
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subfzeo 9-181 
subfzeo. 9-181 
sync 9-182 
tlbia 9-183 
tlore 9-184 
tlbsx 9-186 
tlbsx. 9-186 
tlosync 9-187 
tlbwe 9-188 
tw 9-190 
twi 9-193 
wrtee 9-196 
wrteei 9-197 
xor 9-198 
xori 9-199 
instruction cache array, improved fetcher performance 
4-4 
Instruction Cache Cachability Register. See ICCR 
Instruction Cache Cachability Register. See ICCR 
Instruction Cache Debug Data Register. See ICDBDR 
instruction cache synonym, defined 4-5 
instruction cache unit. See ICU 
instruction fetching 
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instruction fields A-41 
instruction formats 9-2, A-41 
diagrams A-43 
instruction forms A-41, A-43 
instruction queue 
illustrated 2-24 
role in processing instructions 2-23 
instruction set 
brief summaries by category 2-36 
for embedded processors 2-37 
instruction set portability 9-1 
instruction set summary 
cache control 2-41 
CR logical 2-40 
instruction storage interrupts 
causes 5-17 
register settings 5-18 
instruction timings C-3 
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general rules C-3 
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loads and stores C-7 
strings C-6 
instruction TLB. See ITLB 
instructions 
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branch 2-40, B-38 


branch conditional, testing CTR 2-25 


byte-reverse, usefulness of 2-21 
cache 

DAC debug events 8-15 
cache control B-41 
cache control, alignment of 2-16 
compare 2-39 
comparison B-39 
condition register logical B-37 
context synchronizing, defined 2-33 
CR logical 2-39 
extended mnemonics B-9 
format diagrams A-43 
formats A-41 
forms A-41, A-43 
ICU controlling 4-9 
interrupt control 2-41, B-42 
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opcodes A-33 
privileged B-7 
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processor management 2-42, B-44 
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for reading privileged SPRs 2-32 
rotate and shift B-40 
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storage reference B-29 
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interrupt controller 1-8 
interrupt controller interface 1-8 
interrupts 

alignment 2-17 

register settings 5-19 
summary 5-19 

asynchronous, defined 5-1 

behavior 5-1 

Critical 

defined 5-5 
processing 5-6 

critical input 5-13 

data machine check 5-15 

data storage 5-16, 7-10 

register settings 5-17 

debug, register settings 5-26 

defined 5-1 

DTLB miss 7-11 

DTLB, register settings 5-25 

external 

programming note 5-18 
register settings 5-19 

fetching past, speculatively 2-28 

FIT, causes 5-23 

FIT, register settings 5-24 

handling as critical 5-3 

handling priorities 5-3 

handling priorities, illustrated 5-4 

imprecise, defined 5-1 

instruction storage 7-10 

causes 5-17 
register settings 5-18 

ITLB miss 7-11 

ITLB miss, registers 5-25 

machine check, causes of 5-14 

machine check, defined 5-2 

machine check—instruction 

handling 5-14 

register settings 5-15 

synchronism 5-3 
noncritical 

defined 5-5 

processing 5-5 

PIT, register settings 5-22 

precise handling 5-2 

precise, defined 5-1 

program 7-11 

causes 5-20 
ESR usage 5-20 
register settings 5-21 

register settings during critical 5-14 

synchronous, defined 5-2 

system call, register settings 5-22 

TLB miss, preventing 7-11 

TLB-related 7-9 

vector offsets, illustrated 5-6 

WDT, causes 5-24 

WDT, register settings 5-24 
isync 9-70 

andITLB 7-7 


context synchronization, example 2-35 


ITLB (instruction translation lookaside buffer) 
accesses 7-7 
consistency 7-7 
defined 7-6 
miss interrupts 5-25, 7-11 
programming note 7-8 


L 
lbz 9-71 
Ibzu 9-72 
Ibzx 9-74 
lha 9-75 
Ihau 9-76 
Ihax 9-78 
Ihbrx 9-79 
lhz 9-80 
Inzu 9-81 
Inzux 9-82 
Ihzx 9-83 
li 9-9 
Link Register. See LR 
lis 9-12 
little endian 
alignment 2-17 
byte ordering supported 2-19 
defined 2-18 
mapping 2-19 
storage attributes 2-20 
storage regions 
accessing datafrom 2-21 
byte-reverse instructions 2-21= 2-23 
fetching instructions from 2-20 
Imw 9-84 
load strategies, controlled by DCU 4-8 
logical compares 2-11 
logical instructions 
CR 2-39 
overview 2-38 
LR 10-31 
LR (Link Register) 
branch instructions 2-40 
function 2-7 
Iswi 9-85 
Iswx 9-87 
lwarx 9-89 
Iwz 9-91 
Iwzu 9-92 
Iwzux 9-93 
Iwzx 9-94 


macchw 9-95 
macchws 9-96 
macchwsu 9-97 
macchwu 9-98 
machhw 9-99 
machhwsu 9-101 
machhwu 9-102 
machine check interrupts 
causes 5-14 
defined 5-2 
machine check—instruction interrupts 


handling 5-14 
register settings 5-15 
synchronism 5-3 

Machine State Register. See MSR 

maclhw 9-103 

maclhws 9-104, 9-138 

maclhwu 9-106 

mapping 
big endian 2-19 
little endian 2-19 
structure, examples 2-18 

merf 9-107 

merxr 9-108 

memory mapping 
of hardware 2-29 

memory models, non-supported 4-8, 7-5 

memory organization 2-1 

mfcr 9-109 

mfdcr 9-110 

mfmsr 9-111 

mfspr 9-112 

mftb 9-115 

mftbu 9-115 

misalignments, defined 2-17 

MMU (memory management unit) 
accesses, interrupts from 7-10, 7-11 
address translation 7-1 
data storage interrupts 7-10 
DTLB miss interrupts 7-11 
execute permissions 7-14 
general access protection 7-13 
instruction storage interrupts 7-10 
ITLB miss interrupts 7-11 
MSR and access protection 7-13 
overview 1-5 
program interrupts 7-11 


recording page references and changes 7-12 


TLB management 7-11 
zone protection 7-14 


mnemonics,extended. See extended mnemonics 


modes 
execution 2-31 
real, storage attribute control 7-17 
mr 9-140 
mr. 9-140 
MSR 2-13, 10-32 
MSR (Machine State Register) 
bits and exception handling 2-31 
contents after resets 3-2 
controlling execution mode 2-31 
DR bit 7-1 
illustrated 5-7 
interrupt control instructions 2-41 
IR bit 7-1 
programming note 5-7 
summarized 1-9 
mtcr 9-116 
mtcrf 9-116 
mtdcr 9-117 
mtmsr 
execution synchronization 2-35 
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mtspr 9-119 
mulchw 9-121 
mulchwu 9-122 
mulhhw 9-123 
mulhhwu 9-124 
mulhwu 9-126 
mulhwu. 9-126 
mullhw 9-127 
mullhwu 9-128 
mulli 9-129 
mullw 9-130 
mullw. 9-130 
mullwo 9-130 
mullwo. 9-130 


N 

nand 9-131 
nand. 9-131 
neg 9-132 
neg. 9-132 
nego 9-132 
nego. 9-132 


nmacchw 9-133 

nmacchws 9-134 

nmachhw_ 9-135 

nmachhws_ 9-136 

nmaclhw 9-137 

nmaclhws 9-138 

noncritical interrupts 
defined 5-5 
processing 5-5 

nop 9-142 

nor 9-139 

nor. 9-139 

not 9-139 

not. 9-139 

notation xxii, 9-2, A-41 

notational conventions xxii 


O 

opcodes A-33 

optimization 

coding guidelines C-1 

alignment C-2 
boolean variables C-1 
branch prediction C-2 
dependency upon CR C-2 
floating point emulation C-1 

or 9-140 

or. 9-140 

orc 9-141 

orc. 9-141 

ori 9-142 

oris 9-143 

P 

page identification fields, UTLB 7-3 

performance 


DCU 
improve with simultaneous caching 4-17 
limited by sequential caching 4-18 
overview 4-16 

improve 
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through byte-writeability 4-6 
lower 
from cache-inhibited regions 4-5 
PID 10-34 
PID (process ID) 
illustrated 7-13 
PIT 6-4, 10-35 
PIT (programmable interval timer) 
interrupts, register settings 5-22 
portability, instruction set 9-1 
PowerPC architecture 1-3 
precise interrupts 5-1 
pre-fetch 
branches to CTR 2-28 
branches toLR 2-28 
buffers 2-23 
past interrupts 2-28 
primary opcodes A-33 
priority signal 
DCU 4-17 
privileged mode 
defined 2-30 
instructions, listed 2-31 
registers 2-4 
privileged programming model 2-1 
privileged SPRs 
instructions for reading 2-32 
problem state. See user mode 
process ID. See PID 
processor 
management instructions 2-42 
Processor Version Register. See PVR 
program interrupts 
and TLB 7-11 
causes 5-20 
ESR usage 5-20 
programming note 7-11 
register settings 5-21 
programmable interval timer 6-4 
programming model 
features 2-1 
programming models 
privileged 2-1 
user 2-1 
programming note 
data storage interrupts 5-16 
EA accessinDCU 4-9 
external or timer interrupts 5-18 
instruction pipeline 4-15 
MSR affected by instructions 5-7 
non-supported memory models 4-8 
program interrupts 7-11 
reserved fields 2-2 
RPN field 7-4 
synchronizing the ITLB 7-8 
pseudocode 9-2 
PVR 10-36 
PVR (Processor Version Register) 
illustrated 2-10 


R 
real mode 


storage attribute control 
register set summary 1-9 
registers 

categories 2-2, 10-1 

CCRO 10-6 

CR 10-1, 10-8 

CTR 10-9 

DAC1 8-9 


DAC1—DAC2 8-9, 10-10 


DBCR_ 8-4 
DBCRO 10-11, 10-13 
DBSR 8-7, 10-15 
DCCR_ 10-17 
DCR numbering 10-4 
DCRs 
summarized 1-9 
uses for 2-15 
DCWR_ 10-19 
DEAR 10-21 


descriptions of commonly used 2-2 
during debug exceptions 5-26 


ESR 10-23 
EVPR_= 10-25 
GPR_ 10-1 
GPRO-GPR31_ 10-26 
GPRs 
overview 2-5 
summary 1-9 


IAC1-IAC4 10-22, 10-27 


IAC1-IAC4 8-9 
ICCR 10-28 
ICDBDR_ 10-30 
interrupt handling 5-7 
LR 10-31 


MSR 2-13, 10-1, 10-32 


PID 10-34 
PIT 6-4, 10-35 
PVR 10-36 
reserved 10-1 


reserved fields 2-2, 10-1 


SGR_ 10-37 
SLER_ 10-39 
SPR numbering 10-2 
SPRGO-SPRG4 2-10 
SPRGO-SPRG7_ 10-41 
SPRs 
overview 2-5 
summary 1-9 
SRRO 10-42 
SRR1 10-43 
SRR2 10-44 
SRR3 10-45 
SUOR 10-46 
summary of sets 1-9 


supervisor, illustrated 2- 


TBL 10-48 

TBU 10-49 

TCR 6-5, 6-6, 6-9, 
TSR 6-6, 6-8, 10-51 
user, illustrated 2-4 
USPRGO 2-10, 10-52 


4 


10-50 


XER_ 10-53 
ZPR_ 10-54 
reservation bit 9-89, 9-171 
reserved fields 10-1 
programming note 2-2 
reserved registers 10-1 
resets 
effects on MSR 3-2 
effects on SPRs_ 3-3 
processor initialization 3-3 
processor state after 3-1 
rfci 9-144 
effect on MSR reserved fields 5-7 
rfi 9-145 
effect on MSR reserved fields 5-7 
rlwimi 9-146 
rlwimi. 9-146 
rlwinm 9-147 
rlwinm. 9-147 
rlwnm 9-150 
rlwnm. 9-150 
rotlw 9-150 
rotlw. 9-150 
rotlwi 9-148 
rotlwi. 9-148 
rotrwi 9-148 
rotrwi. 9-148 
rxtended mnemonics 
bnectr 9-28 


Ss 
Save/Restore Registers 0-1. See SRRO-1 
sc 9-151 
secondary opcodes A-33 
SGR_ 10-37 
SGR (Storage Guarded Register) 
controlling speculative accesses 2-27 
controlling the guarded (G) storage attribute 7-20 
shadow TLB. See DTLB 
SLER_ 10-39 
SLER (Storage Little Endian Register) 
controlling the endian (E) storage attribute 7-20 
slw 9-152 
slw. 9-152 
slwi 9-148 
slwi. 9-148 
Special Purpose Register General 0-7. See SPRGO-7 
special purpose registers. See SPRs 
speculative accesses 
toCTRorLR 2-28 
defined 2-27 
down predicted path 2-28 
fetching past interrupts 2-28 
fetching past tw or twi 2-29 
fetching past unconditional branches 2-29 
preventing inappropriate 2-27- 2-30 
SPRGO-7 (Special Purpose Register General 0-7) 
temporary storage to 2-9 
SPRGO-SPRG4 2-10 
SPRGO-SPRG7_ 10-41 
SPRs (special purpose registers) 
contents after resets 3-3 
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listed, with page references 2-6 
overview 2-5 
privileged and non-privileged 2-5 
privileged, instructions for reading 2-32 
summary 1-9 

sraw 9-153 

sraw. 9-153 


srawi 
srawi. 
SRRO 


9-154 
9-154 
10-42 


SRRO-1 (Save/Restore Registers 0-1) 
illustrated 5-9 
SRR1_ 10-43 
SRR2 10-44 
SRR3_ 10-45 
srw 9-155 
srw. 9-155 
srwi 9-149 
srwi. 9-149 
stb 9-156 
stobu 9-157 
stbux 9-158 
stbx 9-159 
sth 9-160 
sthbrx 9-161 
sthu 9-162 
sthux 9-163 
sthx 9-164 
stmw 9-165 
storage attribute control registers 
DCCR_ 7-20 
DCWR 7-19 
ICCR 7-20 
SGR_ 7-20 
SLER 7-20 
SUOR 7-20 
storage attributes 
caching inhibited (I) 
realmode 7-20 
virtual mode 7-5 
endian (E) 
and little endian 2-19 
realmode 7-20 
when controlled by TLB_ 7-6 
guarded (G) 
controlling speculative accesses 2-27 
realmode 7-20 
virtual mode 7-6 
memory coherent (M) 
not supported 7-6 
overview 2-2 
realmode 7-17 
TLB control of 7-5 
user-defined (U0) 
realmode 7-20 
virtual mode 7-6 
virtual mode 7-5 
write-through (W) 
realmode 7-19 
virtual mode 7-5 
Storage Guarded Register. See SGR 
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Storage Guarded Register. See SGR 
Storage Little Endian Register. See SLER 
storage reference instructions 2-37 
storage regions 
big endian 
alignment 2-17 
byte-reverse instructions 2-21= 2-22 
little endian 
accessing datafrom 2-21 
alignment 2-17 
byte reversal 2-21 
byte-reverse instructions 2-21= 2-23 
data alignment 2-21 
fetching instructions from 2-20 
storage synchronization 2-35 
Storage User-Defined 0 Register. See SUOR 
string instructions 
access protection 7-17 
structure mapping 
examples 2-18 


stswi 9-166 
stswx 9-167 
stw 9-169 
stwbrx 9-170 
stwex. 9-171 
stwu 9-173 
stwux 9-174 
stwx 9-175 
SUOR 10-46 


SUOR (Storage User-Defined 0 Register) 


controlling the user-defined (UO) storage attribute 


7-20 

sub 9-176 
sub. 9-176 
subc 9-177 
subc. 9-177 
subco 9-177 
subco. 9-177 
subf 9-176 
subf. 9-176 
subfc 9-177 
subfc. 9-177 


subfco 9-177 
subfco. 9-177 
subfe 9-178 
subfe. 9-178 
subfeo 9-178 
subfeo. 9-178 
subfic 9-179 
subfme 9-180 
subfme. 9-180 
subfmeo 9-180 
subfmeo. 9-180 
subfo 9-176 
subfo. 9-176 
subfze 9-181 
subfze. 9-181 
subfzeo 9-181 
subfzeo. 9-181 
subi 9-9 

subic 9-10 


subic. 9-11 
subis 9-12 
subo 9-176 
subo. 9-176 
supervisor state. See privileged mode 
sync 9-182 
storage synchronization 2-35 
synchronization 
context 2-33 
execution, defined 2-35 
ICU 4-6 
references to PowerPC Architecture 2-33 
storage 2-35 
synchronous interrupts 5-2 
system call interrupts 
register settings 5-22 


T 
TBL 10-48 
tblrehi 9-185 
tblrelo 9-185 
tblwehi 9-189 
tblwelo 9-189 
TBU 10-49 


TCR 6-9, 10-50 
TID (translation ID) 
and MMU access protection 
time base 6-1 
implementation 2-13 
writing 2-13 
timer interrupts 
programming note 5-18 
timers 
FIT 6-5 
fixed interval timer 6-5 
PIT 6-4 
programmable interval timer 6-4 
TCR 6-9 
timer control register 6-9 
timer status register 6-8 
TSR 6-8 
watchdog 6-6 
timings 
instruction C-3 
branches and cr logicals C-3 
general rules C-3 
instruction cache misses C-7 
loads and stores C-7 
strings C-6 
TLB (translation lookaside buffer) 7-2 
access protection 7-13, 7-16 
and cacheability control 4-8 
execute permissions 7-14 
interrupts 7-9 
invalidate instruction 7-12 
management instructions 2-42 
preventing miss interrupts 7-11 
read/write instructions 7-12 
search instructions 7-12 
sync instruction 7-12 
zone protection 7-14 
See also ITLB;UTLB;DTLB 


tlbia 9-183 
and TLB management 7-12 
tlore 9-184 
and TLB management 7-12 
tlosx 9-186 
and TLB management 7-12 
tlosx. 9-186 
and TLB management 7-12 
tlbsync 9-187 
and TLB management 7-12 
tlbwe 9-188 
and TLB management 7-12 
translation ID. See TID 
translation lookaside buffer. See TLB 
translation, address. See address translation 
trap 9-191 
TSR 6-8, 10-51 
tw 9-190 
fetching past 2-29 
tweq 9-191 
tweqi 9-194 
twge 9-191 
twgei 9-194 
twgle 9-191 
twgt 9-191 
twgti 9-194 
twi 9-193 
fetching past 2-29 
twle 9-191 
twlei 9-194 
twigei 9-194 
twigt 9-191 
twigti 9-194 
twlle 9-192 
twllei 9-194 
twillt 9-192 
twilti 9-194 
twing 9-192 
twingi 9-194 
twinl 9-192 
twinli 9-195 
twit 9-192 
twiti 9-195 
twne 9-192 
twnei 9-195 
twng 9-192 
twngi 9-195 
twnl 9-192 
twnli 9-195 


U 
unconditional branches 
AA field 2-24 
speculative accesses 2-29 
unified TLB. See UTLB 
user mode 
defined 2-30 
registers 2-4 
user programming model 2-1 
user-defined (U0) storage attribute 
controlled by SUOR 7-20 
virtual mode 7-6 
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USPRGO 2-10, 10-52 

UTLB (unified translation lookaside buffer) 
access control fields 7-5 
entry format, illustrated 7-3 
EPN field 7-3 
EX field 7-5 
field categories 7-3 
functional overview 7-2 
page identification fields 7-3 
RPN field 7-4 
SIZE field 7-4 
TID field 7-4 
translation field 7-4 
V field 7-4 
WR field 7-5 
ZSEL field 7-5 


Vv 
virtual mode 
and TLB control of storage attributes 7-5 


Ww 
watchdog timer 6-6 
WDT (watchdog timer) 
interrupts, causes 5-24 
interrupts, register settings 5-24 
write strategies 
controlled by DOCWR 4-7 
used by DCU 4-7 
write-through (W) storage attribute 
controlled by DOWR_ 7-19 
when controlled by TLB 7-5 
wrtee 9-196 
wrteei 9-197 


X 

XER_ 10-53 

XER (Fixed Point Exception Register) 
illustrated 2-7 

xor 9-198 

xori 9-199 


Z 

zone fault 5-16 

Zone Protection Register. See ZPR 

zone, defined 7-14 

ZPR_ 10-54 

ZPR (Zone Protection Register) 
illustrated 7-14 
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